Internet Assigned Numbers Authority C-DNS DNS Capture Format Created 2019-01-07 Last Updated 2020-12-09 Available Formats [IMG] XML [IMG] HTML [IMG] Plain text Registries included below * C-DNS Transports * C-DNS Storage Flags * C-DNS Response Flags * C-DNS Address Event Types C-DNS Transports Registration Procedure(s) Expert Review Expert(s) Jim Hague, Sara Dickinson, John Dickinson Reference [RFC8618] Note In version 1.0 of C-DNS [RFC8618], there is a field to identify the type of DNS transport. This field is 4 bits in size. Available Formats [IMG] CSV Identifier Name Reference 0 UDP [RFC8618] 1 TCP [RFC8618] 2 TLS [RFC8618] 3 DTLS [RFC8618] 4 HTTPS [RFC8618] 5-14 Unassigned 15 Non-standard transport [RFC8618] C-DNS Storage Flags Registration Procedure(s) Expert Review Expert(s) Jim Hague, Sara Dickinson, John Dickinson Reference [RFC8618] Note In version 1.0 of C-DNS [RFC8618], there is a field describing attributes of the data recorded. The field is a CBOR [RFC8949] unsigned integer holding bit flags. Available Formats [IMG] CSV Bit Name Description Reference 0 anonymized-data The data has been anonymized. [RFC8618] 1 sampled-data The data is sampled data. [RFC8618] 2 normalized-names Names in the data have been normalized. [RFC8618] 3-63 Unassigned C-DNS Response Flags Registration Procedure(s) Expert Review Expert(s) Jim Hague, Sara Dickinson, John Dickinson Reference [RFC8618] Note In version 1.0 of C-DNS [RFC8618], there is a field describing attributes of the responses recorded. The field is a CBOR [RFC8949] unsigned integer holding bit flags. Available Formats [IMG] CSV Bit Name Description Reference 0 from-cache The Response came from cache. [RFC8618] 1-63 Unassigned C-DNS Address Event Types Registration Procedure(s) Expert Review Expert(s) Jim Hague, Sara Dickinson, John Dickinson Reference [RFC8618] Note In version 1.0 of C-DNS [RFC8618], there is a field identifying types of the events related to client addresses. This field is a CBOR [RFC8949] unsigned integer. There is a related optional field "ae-code", which, if present, holds an additional CBOR unsigned integer giving additional information specific to the event type. Available Formats [IMG] CSV Identifier Event Type ae-code contents Reference 0 TCP reset None [RFC8618] 1 ICMP time exceeded ICMP code [icmpcodes] [RFC8618] 2 ICMP destination unreachable ICMP code [icmpcodes] [RFC8618] 3 ICMPv6 time exceeded ICMPv6 code [icmpv6codes] [RFC8618] 4 ICMPv6 destination unreachable ICMPv6 code [icmpv6codes] [RFC8618] 5 ICMPv6 packet too big ICMPv6 code [icmpv6codes] [RFC8618] 6-18446744073709551615 Unassigned Licensing Terms