C-DNS DNS Capture Format

Created
2019-01-07
Last Updated
2019-02-12
Available Formats

XML

HTML

Plain text

Registries included below

C-DNS Transports

Registration Procedure(s)
Expert Review
Expert(s)
Jim Hague, Sara Dickinson, John Dickinson
Reference
[RFC-ietf-dnsop-dns-capture-format-10]
Note
In version 1.0 of C-DNS [RFC-ietf-dnsop-dns-capture-format-10], 
there is a field to identify the type of DNS transport.  This field 
is 4 bits in size.
    
Available Formats

CSV
Identifier Name Reference
0 UDP [RFC-ietf-dnsop-dns-capture-format-10]
1 TCP [RFC-ietf-dnsop-dns-capture-format-10]
2 TLS [RFC-ietf-dnsop-dns-capture-format-10]
3 DTLS [RFC-ietf-dnsop-dns-capture-format-10]
4 DoH [RFC-ietf-dnsop-dns-capture-format-10]
5-15 Unassigned

C-DNS Storage Flags

Registration Procedure(s)
Expert Review
Expert(s)
Jim Hague, Sara Dickinson, John Dickinson
Reference
[RFC-ietf-dnsop-dns-capture-format-10]
Note
In version 1.0 of C-DNS [RFC-ietf-dnsop-dns-capture-format-10], 
there is a field describing attributes of the data recorded.  The 
field is a CBOR [RFC7049] unsigned integer holding bit flags.
    
Available Formats

CSV
Bit Name Description Reference
0 anonymised-data The data has been anonymised. [RFC-ietf-dnsop-dns-capture-format-10]
1 sampled-data The data is sampled data. [RFC-ietf-dnsop-dns-capture-format-10]
2 normalized-names Names in the data have been normalized. [RFC-ietf-dnsop-dns-capture-format-10]
3-63 Unassigned

C-DNS Response Flags

Registration Procedure(s)
Expert Review
Expert(s)
Jim Hague, Sara Dickinson, John Dickinson
Reference
[RFC-ietf-dnsop-dns-capture-format-10]
Note
In version 1.0 of C-DNS [RFC-ietf-dnsop-dns-capture-format-10], 
there is a field describing attributes of the responses recorded.  
The field is a CBOR [RFC7049] unsigned integer holding bit flags.
    
Available Formats

CSV
Bit Name Description Reference
0 from-cache The response came from cache. [RFC-ietf-dnsop-dns-capture-format-10]
1-63 Unassigned

C-DNS Address Event Types

Registration Procedure(s)
Expert Review
Expert(s)
Jim Hague, Sara Dickinson, John Dickinson
Reference
[RFC-ietf-dnsop-dns-capture-format-10]
Note
In version 1.0 of C-DNS [RFC-ietf-dnsop-dns-capture-format-10], 
there is a field identifying types of the events related to client 
addresses.  This field is a CBOR [RFC7049] unsigned integer.  There 
is a related optional field "ae-code", which, if present, holds an 
additional CBOR unsigned integer giving additional information 
specific to the event type.
    
Available Formats

CSV
Identifier Event Type ae-code contents Reference
0 TCP reset None [RFC-ietf-dnsop-dns-capture-format-10]
1 ICMP time exceeded ICMP code [icmpcodes] [RFC-ietf-dnsop-dns-capture-format-10]
2 ICMP destination unreachable ICMP code [icmpcodes] [RFC-ietf-dnsop-dns-capture-format-10]
3 ICMPv6 time exceeded ICMPv6 code [icmpv6codes] [RFC-ietf-dnsop-dns-capture-format-10]
4 ICMPv6 destination unreachable ICMPv6 code [icmpv6codes] [RFC-ietf-dnsop-dns-capture-format-10]
5 ICMPv6 packet too big ICMPv6 code [icmpv6codes] [RFC-ietf-dnsop-dns-capture-format-10]
6-18446744073709551615 Unassigned