mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
fe8390c646
Parse authentic data (AD) and checking disabled (CD) bits according to RFC 2535. Leaves the Z field as-is, in case users are already handling this elsewhere and depend on the value being the integer for all 3 bits. https://www.rfc-editor.org/rfc/rfc2535#section-6.1 Fixes #2672
11 lines
1.2 KiB
Text
11 lines
1.2 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path dns
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id rtt query qclass qclass_name qtype qtype_name rcode rcode_name AA TC RD RA Z AD CD answers TTLs rejected auth addl
|
|
#types time string addr port addr port enum count interval string count string count string count string bool bool bool bool count bool bool vector[string] vector[interval] bool set[string] set[string]
|
|
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.87.3.74 51871 10.87.1.10 53 udp 27571 0.002004 example.net 1 C_INTERNET 65534 query-65534 0 NOERROR T F T T 2 F F BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal,BIND9 signing signal 0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000 F - -
|
|
#close XXXX-XX-XX-XX-XX-XX
|