title: Extracting DNS info from a captured packet in C
body: <p>I am using below code from <a href="https://github.com/uvic-sdo/DNS-Packet-Parser/blob/master/print.c" rel="nofollow">here</a> to print DNS information from captured packets. It perfectly words till I print out the TTL. </p>
  
  <pre><code>packet_desc* pd = (packet_desc*)pack;
  printf("IP HEADER\n");  
  printf("%ssource:%s\n", tab, inet_ntoa(pd-&gt;ip.src) );
  printf("%sdest:%s\n", tab, inet_ntoa(pd-&gt;ip.dst) );
  printf("UDP HEADER\n"); 
  printf("%ssource port:%d\n", tab, ntohs(pd-&gt;udp.sport) );   
  printf("%sdest port:%d\n", tab, ntohs(pd-&gt;udp.dport) ); 
  
  printf("DNS HEADER\n");
  printf("%sid:%d\n", tab, ntohs(pd-&gt;dns.id));
  printf("%sflags:%d\n", tab, ntohs(pd-&gt;dns.flags));
  printf("%s# questions:%d\n", tab, ntohs(pd-&gt;dns.qdcount));
  printf("%s# answers:%d\n", tab, ntohs(pd-&gt;dns.ancount));
  printf("%s# ns:%d\n", tab, ntohs(pd-&gt;dns.nscount));
  printf("%s# ar:%d\n", tab, ntohs(pd-&gt;dns.arcount));
  
  
  printf("RESOURCE RECORDS\n");
  int numRRs = ntohs(pd-&gt;dns.qdcount) + ntohs(pd-&gt;dns.ancount) + ntohs(pd-&gt;dns.nscount) + ntohs(pd-&gt;dns.arcount);
  int i;
  if (ntohs(pd-&gt;udp.sport) == 53)
  {
  //numRRs = 0;   
  for(i=0; i&lt;numRRs; i++){
      printf("SizeofURL:(%d)", sizeofUrl(pd-&gt;data)-2); print_url(pd-&gt;data); printf("\n");
      // extract variables
      static_RR* RRd = (static_RR*)((void*)pd-&gt;data + sizeofUrl(pd-&gt;data));
      int type = ntohs(RRd-&gt;type);
      if (type == 1)
      {
          int ttl = (uint32_t)ntohl(RRd-&gt;ttl);
          printf("%sTTL:%d \n", tab, ttl);
      }
  }
  </code></pre>
  
  <p>The output off the above code looks like this:</p>
  
  <pre><code>IP HEADER
     source:192.168.1.1
     dest:192.168.1.7
  UDP HEADER
     source port:53
     dest port:64740
  DNS HEADER
     id:44005
     flags:33152
     # questions:1
     # answers:1
     # ns:0
     # ar:0
  RESOURCE RECORDS
  SizeofURL:(16).www.google.co.nz
     TTL:-1072955391 
  SizeofURL:(16).www.google.co.nz
     TTL:-1072955391 
  </code></pre>
  
  <p>any idea what's wrong with the code? Is using "ns_parserr" the best way to go?</p>