C-DNS DNS Capture Format

Created

  • 2019-01-07

Last Updated

  • 2020-12-09

Available Formats


C-DNS Transports

Registration Procedure(s)

  • Expert Review

Expert(s)

  • Jim Hague, Sara Dickinson, John Dickinson

Reference

  • RFC 8618: Compacted-DNS (C-DNS): A Format for DNS Packet Capture

Note

In version 1.0 of C-DNS RFC 8618, there is a field to identify the type of DNS transport. This field is 4 bits in size.

Available Formats

Identifier Name Reference
0 UDP RFC 8618
1 TCP RFC 8618
2 TLS RFC 8618
3 DTLS RFC 8618
4 HTTPS RFC 8618
5-14 Unassigned
15 Non-standard transport RFC 8618

C-DNS Storage Flags

Registration Procedure(s)

  • Expert Review

Expert(s)

  • Jim Hague, Sara Dickinson, John Dickinson

Reference

  • RFC 8618: Compacted-DNS (C-DNS): A Format for DNS Packet Capture

Note

In version 1.0 of C-DNS RFC 8618, there is a field describing attributes of the data recorded. The field is a CBOR RFC 8949 unsigned integer holding bit flags.

Available Formats

Bit Name Description Reference
0 anonymized-data The data has been anonymized. RFC 8618
1 sampled-data The data is sampled data. RFC 8618
2 normalized-names Names in the data have been normalized. RFC 8618
3-63 Unassigned

C-DNS Response Flags

Registration Procedure(s)

  • Expert Review

Expert(s)

  • Jim Hague, Sara Dickinson, John Dickinson

Reference

  • RFC 8618: Compacted-DNS (C-DNS): A Format for DNS Packet Capture

Note

In version 1.0 of C-DNS RFC 8618, there is a field describing attributes of the responses recorded. The field is a CBOR RFC 8949 unsigned integer holding bit flags.

Available Formats

Bit Name Description Reference
0 from-cache The Response came from cache. RFC 8618
1-63 Unassigned

C-DNS Address Event Types

Registration Procedure(s)

  • Expert Review

Expert(s)

  • Jim Hague, Sara Dickinson, John Dickinson

Reference

  • RFC 8618: Compacted-DNS (C-DNS): A Format for DNS Packet Capture

Note

In version 1.0 of C-DNS RFC 8618, there is a field identifying types of the events related to client addresses. This field is a CBOR RFC 8949 unsigned integer. There is a related optional field "ae-code", which, if present, holds an additional CBOR unsigned integer giving additional information specific to the event type.

Available Formats

Identifier Event Type ae-code contents Reference
0 TCP reset None RFC 8618
1 ICMP time exceeded ICMP code icmpcodes RFC 8618
2 ICMP destination unreachable ICMP code icmpcodes RFC 8618
3 ICMPv6 time exceeded ICMPv6 code icmpv6codes RFC 8618
4 ICMPv6 destination unreachable ICMPv6 code icmpv6codes RFC 8618
5 ICMPv6 packet too big ICMPv6 code icmpv6codes RFC 8618
6-18446744073709551615 Unassigned