base/protocols/dns/consts.bro

DNS

Types, errors, and fields for analyzing DNS data. A helper file for DNS analysis scripts.

Namespace:DNS Source File:/scripts/base/protocols/dns/consts.bro

Summary

Constants

DNS::ANY: count	A QTYPE value describing a request for all records.
DNS::EDNS: count	An OPT RR TYPE value described by EDNS.
DNS::PTR: count	RR TYPE value for a domain name pointer.
DNS::algorithms: table &default = function &optional	Possible values of the algorithms used in DNSKEY, DS and RRSIG records
DNS::base_errors: table &default = function &optional	Errors used for non-TSIG/EDNS types.
DNS::classes: table &default = function &optional	Possible values of the CLASS field in resource records or QCLASS field in query messages.
DNS::digests: table &default = function &optional	Possible digest types used in DNSSEC.
DNS::edns_zfield: table &default = "?" &optional	This deciphers EDNS Z field values.
DNS::query_types: table &default = function &optional	Mapping of DNS query type codes to human readable string representation.

Detailed Interface

Constants

DNS::ANY

Type:count Default:255

A QTYPE value describing a request for all records.

DNS::EDNS

Type:count Default:41

An OPT RR TYPE value described by EDNS.

DNS::PTR

Type:count Default:12

RR TYPE value for a domain name pointer.

DNS::algorithms

Type:table [count] of string Attributes:&default = function &optional Default:

{
   [3] = "DSA_SHA1",
   [8] = "RSA_SHA256",
   [254] = "PrivateOID",
   [7] = "RSA_SHA1_NSEC3_SHA1",
   [10] = "RSA_SHA512",
   [1] = "RSA_MD5",
   [252] = "Indirect",
   [2] = "Diffie_Hellman",
   [4] = "Elliptic_Curve",
   [15] = "Ed25519",
   [255] = "reserved255",
   [6] = "DSA_NSEC3_SHA1",
   [0] = "reserved0",
   [253] = "PrivateDNS",
   [12] = "GOST_R_34_10_2001",
   [16] = "Ed448",
   [5] = "RSA_SHA1",
   [13] = "ECDSA_curveP256withSHA256",
   [14] = "ECDSA_curveP384withSHA384"
}

Possible values of the algorithms used in DNSKEY, DS and RRSIG records

DNS::base_errors

Type:table [count] of string Attributes:&default = function &optional Default:

{
   [3] = "NXDOMAIN",
   [8] = "NXRRSet",
   [11] = "unassigned-11",
   [22] = "BADTRUNC",
   [7] = "YXRRSET",
   [20] = "BADNAME",
   [21] = "BADALG",
   [10] = "NOTZONE",
   [18] = "BADTIME",
   [1] = "FORMERR",
   [2] = "SERVFAIL",
   [4] = "NOTIMP",
   [15] = "unassigned-15",
   [3842] = "BADSIG",
   [6] = "YXDOMAIN",
   [9] = "NOTAUTH",
   [0] = "NOERROR",
   [17] = "BADKEY",
   [12] = "unassigned-12",
   [16] = "BADVERS",
   [5] = "REFUSED",
   [13] = "unassigned-13",
   [14] = "unassigned-14",
   [19] = "BADMODE"
}

Errors used for non-TSIG/EDNS types.

DNS::classes

Type:table [count] of string Attributes:&default = function &optional Default:

{
   [3] = "C_CHAOS",
   [254] = "C_NONE",
   [1] = "C_INTERNET",
   [2] = "C_CSNET",
   [4] = "C_HESOD",
   [255] = "C_ANY"
}

Possible values of the CLASS field in resource records or QCLASS field in query messages.

DNS::digests

Type:table [count] of string Attributes:&default = function &optional Default:

{
   [3] = "GOST_R_34_11_94",
   [1] = "SHA1",
   [2] = "SHA256",
   [4] = "SHA384",
   [0] = "reserved0"
}

Possible digest types used in DNSSEC.

DNS::edns_zfield

Type:table [count] of string Attributes:&default = "?" &optional Default:

{
   [0] = "NOVALUE",
   [32768] = "DNS_SEC_OK"
}

This deciphers EDNS Z field values.

DNS::query_types

Type:table [count] of string Attributes:&default = function &optional Default:

{
   [11] = "WKS",
   [37] = "CERT",
   [38] = "A6",
   [36] = "KX",
   [257] = "CAA",
   [26] = "PX",
   [59] = "CDS",
   [103] = "UNSPEC",
   [46] = "RRSIG",
   [51] = "NSEC3PARAM",
   [1] = "A",
   [24] = "SIG",
   [5] = "CNAME",
   [251] = "IXFR",
   [21] = "RT",
   [99] = "SPF",
   [22] = "NSAP",
   [101] = "UID",
   [250] = "TSIG",
   [255] = "*",
   [7] = "MB",
   [9] = "MR",
   [49] = "DHCID",
   [32] = "NB",
   [253] = "MAILB",
   [32769] = "DLV",
   [23] = "NSAP-PTR",
   [6] = "SOA",
   [39] = "DNAME",
   [102] = "GID",
   [47] = "NSEC",
   [13] = "HINFO",
   [4] = "MF",
   [31] = "NIMLOC",
   [60] = "CDNSKEY",
   [25] = "KEY",
   [29] = "LOC",
   [3] = "MD",
   [33] = "SRV",
   [40] = "SINK",
   [2] = "NS",
   [8] = "MG",
   [50] = "NSEC3",
   [52] = "TLSA",
   [35] = "NAPTR",
   [256] = "URI",
   [14] = "MINFO",
   [249] = "TKEY",
   [34] = "ATMA",
   [19] = "X25",
   [30] = "EID",
   [10] = "NULL",
   [41] = "OPT",
   [42] = "APL",
   [252] = "AXFR",
   [254] = "MAILA",
   [32768] = "TA",
   [100] = "UINFO",
   [43] = "DS",
   [45] = "IPSECKEY",
   [15] = "MX",
   [44] = "SSHFP",
   [17] = "RP",
   [27] = "GPOS",
   [20] = "ISDN",
   [48] = "DNSKEY",
   [55] = "HIP",
   [12] = "PTR",
   [18] = "AFSDB",
   [28] = "AAAA",
   [16] = "TXT",
   [61] = "OPENPGPKEY"
}

Mapping of DNS query type codes to human readable string representation.