zeek/testing/btest/Traces/dns/dns_extended_rcode.pcap
Johanna Amann 383dce9343 Fix parsing of EDNS rcode
The EDNS rcode was incorrectly calculated. The extended rcode is formed
by taking the upper 8 bits of the extended rcode field, plus the lower 4
bits of the existing rcode.

This also adds a new trace with an extended rcode, and a testcase
parsing it.

Reported by dwhitemv25.

Fixes GH-4656
2025-07-24 14:57:00 +01:00

202 B