Next: , Up: dns Analysis Script


7.13.1 The dns_mapping record

All of the events handled by the module include at least one record of DNS mapping information, defined by the dns_mapping type shown in the example below. The corresponding fields are:

`creation_time'
When the mapping was created.
`req_host'
The hostname looked up, or an empty string if this was not a hostname lookup.
`req_addr'
The address looked up (reverse lookup), or 0.0.0.0 if this was not an address lookup.
`valid'
True if an answer was received for a lookup (even if the answer was that the request name or address does not exist in the DNS).
`hostname'
The hostname answer in response to an address lookup, or the string "<none>" if an answer was received but it indicated there was no PTR record for the given address.
`addrs'
A set of addresses in response to a hostname lookup. Empty if an answer was received but it indicated that there was no A record for the given hostname.
     type dns_mapping: record {
         creation_time: time;  # When the mapping was created.
     
         req_host: string;     # The hostname in the request, if any.
         req_addr: addr;       # The address in the request, if any.
     
         valid: bool;          # Whether we received an answer.
         hostname: string;     # The hostname in the answer, or "<none>".
         addrs: set[addr];     # The addresses in the answer, if any.
     };