mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
cf2da5160b
There was a misunderstanding whether to include them by default in the dns.log, so remove them again. There had also been a discussion and quirk that AD of a request would always be overwritten by reply in the dns.log unless the reply is missing. For now, let users extend dns.log themselves for what best fits their requirements, rather than adding these flags by default. Add a btest to print AD and CD flags for smoke testing still.
15 lines
470 B
Text
15 lines
470 B
Text
# @TEST-EXEC: zeek -b -C -r $TRACES/dnssec/dnskey.pcap %INPUT > output
|
|
# @TEST-EXEC: zeek -b -C -r $TRACES/dnssec/dnskey2.pcap %INPUT >> output
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output
|
|
|
|
@load base/protocols/dns
|
|
|
|
event zeek_init()
|
|
{
|
|
print "===", packet_source()$path;
|
|
}
|
|
|
|
event dns_message(c: connection, is_orig: bool, msg: dns_msg, len: count)
|
|
{
|
|
print c$uid, "is_orig", is_orig, "QR", msg$QR, "AD", msg$AD, "CD", msg$CD;
|
|
}
|