mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
5f0023b3b0
SPF response records are identical to TXT records in structure, and can be parsed and interpreted the same way. However, they have a different RR type, so they would generate weird events and not be parsed by Zeek before this change. Even though they're the same as TXT records from a protocol stance, I created a new event type (dns_SPF_reply), and call the records out as SPF in the logs, instead of as TXT records, since the distinction could be important for detection purposes. SPF records have been obsoleted, but continue to be seen in the wild. |
||
|---|---|---|
| .. | ||
| files | ||
| frameworks | ||
| misc | ||
| protocols | ||
| utils | ||
| init-bare.zeek | ||
| init-default.zeek | ||
| init-frameworks-and-bifs.zeek | ||