1syntax = "proto2"; 2package nmsg.base; 3 4message DnsQR { 5 enum DnsQRType { 6 UDP_INVALID = 0; 7 UDP_QUERY_RESPONSE = 1; 8 UDP_UNANSWERED_QUERY = 2; 9 UDP_UNSOLICITED_RESPONSE = 3; 10 TCP = 4; 11 ICMP = 5; 12 UDP_QUERY_ONLY = 6; 13 UDP_RESPONSE_ONLY = 7; 14 } 15 16 enum UdpChecksum { 17 ERROR = 0; 18 ABSENT = 1; 19 INCORRECT = 2; 20 CORRECT = 3; 21 } 22 23 required DnsQRType type = 1; 24 25 // the 9-tuple 26 27 required bytes query_ip = 2; 28 required bytes response_ip = 3; 29 required uint32 proto = 4; 30 required uint32 query_port = 5; 31 required uint32 response_port = 6; 32 33 required uint32 id = 7; 34 optional bytes qname = 8; 35 optional uint32 qtype = 9; 36 optional uint32 qclass = 10; 37 38 // rcode from the response 39 40 optional uint32 rcode = 11; 41 42 // packet data 43 44 repeated bytes query_packet = 12; 45 repeated int64 query_time_sec = 13; 46 repeated sfixed32 query_time_nsec = 14; 47 48 repeated bytes response_packet = 15; 49 repeated int64 response_time_sec = 16; 50 repeated sfixed32 response_time_nsec = 17; 51 52 // only used if type = TCP 53 54 optional bytes tcp = 18; 55 56 // only used if type = ICMP 57 58 optional bytes icmp = 19; 59 60 // only set for UDP_UNANSWERED_QUERY 61 62 optional double timeout = 20; 63 64 // the result of UDP checksum verification of the response datagram. 65 // note that the query datagram isn't checksummed, since a) the relevant 66 // information from the query is almost always included in the response, 67 // b) when capturing from the perspective of an initiator, the outbound 68 // query is commonly subject to UDP checksum offload and will be incorrect 69 // anyway. 70 71 optional UdpChecksum udp_checksum = 21; 72 73 // set if the address of the initiator was zeroed. 74 75 optional bool resolver_address_zeroed = 22; 76} 77