The dns Task
DNS parses a DNS payload.
The dns Task requires the capture or payload Task as a Source Task for the
Directive.
|
Output
- dns
-
map
dnsis a an object with the following fields: - dns.MsgHdr
-
map
dns.MsgHdrcontains DNS id and bits. - dns.MsgHdr.Id
-
uint16 A 16 bit identifier assigned by the program that generates any kind of query. This identifier is copied the corresponding reply and can be used by the requester to match up replies to outstanding queries.
- dns.MsgHdr.Response
-
bool Identifies the DNS Message as a Response if true.
- dns.MsgHdr.Opcode
-
int A four bit field that specifies kind of query in this message.
- dns.MsgHdr.Authoritative
-
bool Authoritative Answer - this bool is only meaningful in responses, and specifies that the responding name server is an authority for the domain name in question section.
- dns.MsgHdr.Truncated
-
bool Specifies that this message was truncated if true.
- dns.MsgHdr.RecursionDesired
-
bool This bool directs the name server to pursue the query recursively.
- dns.MsgHdr.RecursionAvailable
-
bool This be is set or cleared in a response, and denotes whether recursive query support is available in the name server.
- dns.MsgHdr.Zero
-
bool Reserved for future use. Should be false.
- dns.MsgHdr.AuthenticatedData
-
bool The Authenticated Data bool indicates in a response that all data included in the answer and authority sections of the response have been authenticated by the server according to the policies of that server.
- dns.MsgHdr.CheckingDisabled
-
bool The Checking Disabled bool indicates in a query that non-verified data is acceptable to the resolver sending the query.
- dns.MsgHdr.Rcode
-
int Response code - this 4 bit field is set as part of responses. The values have the following interpretation: +
-
0 No error condition
-
1 Format error - The name server was unable to interpret the query.
-
2 Server failure - The name server was unable to process this query due to a problem with the name server.
-
3 Name Error - Meaningful only for responses from an authoritative name server, this code signifies that the domain name referenced in the query does not exist.
-
4 Not Implemented - The name server does not support the requested kind of query.
-
5 Refused - The name server refuses to perform the specified operation for policy reasons
-
- dns.Question
-
array Holds the Resource Records of the question section.
- dns.Question.Name
-
string The name of question.
- dns.Question.Qtype
-
uint16 The type of question.
- dns.Question.Qclass
-
uint16 The class of question.
- dns.Question.Qclass
-
uint16 The class of question.
- dns.Answer
-
array Holds the Resource Records of the answer section.
- dns.Answer.Hdr
-
array Holds shared Resource Records fields.
- dns.Answer.Hdr.Name
-
string The name of answer.
- dns.Answer.Hdr.Rrtype
-
uint16 The type of answer.
- dns.Answer.Hdr.Class
-
uint16 The class of answer.
- dns.Answer.Hdr.Ttl
-
uint32 The TTL of answer.
- dns.Answer.Hdr.Rdlength
-
uint16 The length of data after header.
- dns.Ns
-
array Holds the Resource Records of the NS section.
- dns.Ns.Hdr
-
array Holds shared Resource Records fields.
- dns.Ns.Hdr.Name
-
string The name of answer.
- dns.Ns.Hdr.Rrtype
-
uint16 The type of answer.
- dns.Ns.Hdr.Class
-
uint16 The class of answer.
- dns.Ns.Hdr.Ttl
-
uint32 The TTL of answer.
- dns.Ns.Hdr.Rdlength
-
uint16 The length of data after header.
- dns.Extra
-
array Holds the Resource Records of the Extra section.
- dns.Extra.Hdr
-
array Holds shared Resource Records fields.
- dns.Extra.Hdr.Name
-
string The name of answer.
- dns.Extra.Hdr.Rrtype
-
uint16 The type of answer.
- dns.Extra.Hdr.Class
-
uint16 The class of answer.
- dns.Extra.Hdr.Ttl
-
uint32 The TTL of answer.
- dns.Extra.Hdr.Rdlength
-
uint16 The length of data after header.