search

dmachard / go-dnscollector

Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.
MIT License
188 stars 44 forks source link

TCP encoding for PCAP logger - truncated response #167

Closed tomarcade closed 1 year ago

tomarcade commented 1 year ago

Regarding https://github.com/dmachard/go-dns-collector/issues/157#issuecomment-1314875005: Having a PCAP logger and enforcing the query with TCP (dig +tcp ...) or with a response, which must be truncated, then we only see the TCP query and no response.

For example a truncated response (from PCAP logger-output, shown with tshark)

Querying the server (dig @server www.example.ch AAAA)

Frame 3: 97 bytes on wire (776 bits), 97 bytes captured (776 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 10.100.2.62, Dst: 10.100.102.21
User Datagram Protocol, Src Port: 40772, Dst Port: 53
Domain Name System (query)
    Transaction ID: 0xf7b2
    Flags: 0x0120 Standard query
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..1. .... = AD bit: Set
        .... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        www.example.ch: type AAAA, class IN
            Name: www.example.ch
            [Name Length: 14]
            [Label Count: 3]
            Type: AAAA (IPv6 Address) (28)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (41)
            UDP payload size: 1232
            Higher bits in extended RCODE: 0x00
            EDNS0 version: 0
            Z: 0x0000
                0... .... .... .... = DO bit: Cannot handle DNSSEC security RRs
                .000 0000 0000 0000 = Reserved: 0x0000
            Data length: 12
            Option: COOKIE
                Option Code: COOKIE (10)
                Option Length: 8
                Option Data: e8852c36809558c8
                Client Cookie: e8852c36809558c8
                Server Cookie: <MISSING>

UDP-Response with Truncated-Flag set:

Frame 4: 113 bytes on wire (904 bits), 113 bytes captured (904 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 10.100.102.21, Dst: 10.100.2.62
User Datagram Protocol, Src Port: 53, Dst Port: 40772
Domain Name System (response)
    Transaction ID: 0xf7b2
    Flags: 0x8780 Standard query response, No error
        1... .... .... .... = Response: Message is a response
        .000 0... .... .... = Opcode: Standard query (0)
        .... .1.. .... .... = Authoritative: Server is an authority for domain
        .... ..1. .... .... = Truncated: Message is truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... 1... .... = Recursion available: Server can do recursive queries
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
        .... .... ...0 .... = Non-authenticated data: Unacceptable
        .... .... .... 0000 = Reply code: No error (0)
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        www.example.ch: type AAAA, class IN
            Name: www.example.ch
            [Name Length: 14]
            [Label Count: 3]
            Type: AAAA (IPv6 Address) (28)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (41)
            UDP payload size: 1232
            Higher bits in extended RCODE: 0x00
            EDNS0 version: 0
            Z: 0x0000
                0... .... .... .... = DO bit: Cannot handle DNSSEC security RRs
                .000 0000 0000 0000 = Reserved: 0x0000
            Data length: 28
            Option: COOKIE
                Option Code: COOKIE (10)
                Option Length: 24
                Option Data: e8852c36809558c80100000063735e1a4c3e81b1c4692d53
                Client Cookie: e8852c36809558c8
                Server Cookie: 0100000063735e1a4c3e81b1c4692d53
    [Request In: 3]
    [Time: 0.000306000 seconds]

PCAP-Logging output shows only the TCP query

Frame 5: 127 bytes on wire (1016 bits), 127 bytes captured (1016 bits)
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 10.100.2.62, Dst: 10.100.102.21
Transmission Control Protocol, Src Port: 36295, Dst Port: 53, Seq: 1, Len: 73
Domain Name System (query)
    Length: 71
    Transaction ID: 0x3119
    Flags: 0x0120 Standard query
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...1 .... .... = Recursion desired: Do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ..1. .... = AD bit: Set
        .... .... ...0 .... = Non-authenticated data: Unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        www.example.ch: type AAAA, class IN
            Name: www.example.ch
            [Name Length: 14]
            [Label Count: 3]
            Type: AAAA (IPv6 Address) (28)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (41)
            UDP payload size: 1232
            Higher bits in extended RCODE: 0x00
            EDNS0 version: 0
            Z: 0x0000
                0... .... .... .... = DO bit: Cannot handle DNSSEC security RRs
                .000 0000 0000 0000 = Reserved: 0x0000
            Data length: 28
            Option: COOKIE
                Option Code: COOKIE (10)
                Option Length: 24
                Option Data: e8852c36809558c80100000063735e1a4c3e81b1c4692d53
                Client Cookie: e8852c36809558c8
                Server Cookie: 0100000063735e1a4c3e81b1c4692d53

The complete dig response looks like this:

$ dig @test www.example.ch AAAA
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.18.7 <<>> @test www.example.ch AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12569
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 222, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: e8852c36809558c80100000063735e1a4c3e81b1c4692d53 (good)
;; QUESTION SECTION:
;www.example.ch.            IN  AAAA

;; ANSWER SECTION:
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:dd00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ce00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:eb00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:cd00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:fe00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ed00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:fa00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ae00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ab00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:fd00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:bb00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:be00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:da00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ac00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:aa00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:1600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:cc00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ba00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:a200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:7c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9a00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:9300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ca00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:bd00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:bc00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:cb00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:dc00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5200::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:2b00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8d00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:4c00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:c000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:db00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:8500::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:b300::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:e600::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ea00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f000::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:5100::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ec00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:6800::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ee00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:ad00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:f400::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:fc00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:de00::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:3900::affe
www.example.ch.     1800    IN  AAAA    2001:db8:cafe:d600::affe

;; Query time: 0 msec
;; SERVER: 10.100.102.21#53(test) (TCP)
;; WHEN: Tue Nov 15 10:38:34 CET 2022
;; MSG SIZE  rcvd: 6287
dmachard commented 1 year ago

FYI , UDP-Response with Truncated-Flag are properly decoded in release v0.29.0 (beta release) and no more dropped like before.

dmachard commented 1 year ago

full support of truncated dns message and tcp fragments in v0.30.0 beta1

dmachard commented 1 year ago

Implemented in release v0.30.0.

tomarcade commented 1 year ago

Perfect, thanks a lot!