|
The basic data structure for a DNS_HEADER type is unusually complex, given the non-byte boundries that most of the structure components live on. In bigendin machines, the structure looks like:
|
||
An example of using the data structure can be found in the
initial packetClean function:q_count = ntohs(dnsheader->qdcount); /* number of question records */Here we extract the number of question records contained within the record we are looking at. In the next rev of the spp, I hope to abstract out the header structure and provide a means to tune the 'good' vs. 'bad' packet defn via some other way than the actual spp code. This may take some doing ...
|
DNS Header Data
Abstraction The Domain Name Service (DNS) protocol searches for resources using a database distributed among different name servers. The DNS message header structure is shown in the following illustration:
DNS message header structure ID Q Query
A T R V B RCode
Question count Answer count Authority count Additional count |
|