Product Documentation

Expressions for Evaluating a DNS Message and Identifying Its Carrier Protocol

Aug 31, 2016

You can evaluate DNS requests and responses by using expressions that begin with DNS.REQ and DNS.RES, respectively. You can also identify the transport layer protocol that is being used to send the DNS messages.

The following functions return the contents of a DNS query.

Table 1. Functions that return the contents of a DNS query
Function Description
DNS.REQ.QUESTION.DOMAIN

Return the domain name (the value of the QNAME field) in the question section of the DNS query. The domain name is returned as a text string, which can be passed to EQ(), NE(), and any other functions that work with text.

DNS.REQ.QUESTION.TYPE

Return the query type (the value of the QTYPE field) in the DNS query. The field indicates the type of resource record (for example, A, NS, or CNAME) for which the name server is being queried. The returned value can be compared to one of the following values by using the EQ() and NE() functions:

  • A
  • AAAA
  • NS
  • SRV
  • PTR
  • CNAME
  • SOA
  • MX
  • ANY
Note: You can use only the EQ() and NE() functions with the TYPE function.

Example:

DNS.REQ.QUESTION.TYPE.EQ(MX)

The following functions return the contents of a DNS response.

Table 2. Functions that return the contents of a DNS response
Function Description
DNS.RES.HEADER.RCODE
Return the response code (the value of the RCODE field) in the header section of the DNS response. You can use only the EQ() and NE() functions with the RCODE function. Following are the possible values:
  • NOERROR
  • FORMERR
  • SERVFAIL
  • NXDOMAIN
  • NOTIMP
  • REFUSED
DNS.RES.QUESTION.DOMAIN

Return the domain name (the value of the QNAME field) in the question section of the DNS response. The domain name is returned as a text string, which can be passed to EQ(), NE(), and any other functions that work with text.

DNS.RES.QUESTION.TYPE
Return the query type (the value of the QTYPE field) in the question section of the DNS response. The field indicates the type of resource record (for example, A, NS, or CNAME) that is contained in the response. The returned value can be compared to one of the following values by using the EQ() and NE() functions:
  • A
  • AAAA
  • NS
  • SRV
  • PTR
  • CNAME
  • SOA
  • MX
  • ANY

You can use only the EQ() and NE() functions with the TYPE function.

Example:

DNS.RES.QUESTION.TYPE.EQ(SOA)

The following functions return the transport layer protocol name.

Table 3. Functions that return the transport layer protocol name
Function Description
DNS.REQ.TRANSPORT

Return the name of the transport layer protocol that was used to send the DNS query. Possible values returned are TCP and UDP. You can use only the EQ() and NE() functions with the TRANSPORT function.

Example:

DNS.REQ.TRANSPORT.EQ(TCP)

DNS.RES.TRANSPORT

Return the name of the transport layer protocol that was used for the DNS response. Possible values returned are TCP and UDP. You can use only the EQ() and NE() functions with the TRANSPORT function.

Example:

DNS.RES.TRANSPORT.EQ(TCP)