C-DNS DNS Capture Format

Created: 2019-01-07
Last Updated: 2020-12-09
Available Formats: XML
HTML
Plain text

Registries included below

C-DNS Transports
C-DNS Storage Flags
C-DNS Response Flags
C-DNS Address Event Types

C-DNS Transports

Registration Procedure(s)

Expert Review

Expert(s)

Jim Hague, Sara Dickinson, John Dickinson

Reference

Note

In version 1.0 of C-DNS [RFC8618], there is a field to identify the 
type of DNS transport.  This field is 4 bits in size.

Available Formats

CSV

Identifier	Name	Reference
0	UDP	[RFC8618]
1	TCP	[RFC8618]
2	TLS	[RFC8618]
3	DTLS	[RFC8618]
4	HTTPS	[RFC8618]
5-14	Unassigned
15	Non-standard transport	[RFC8618]

C-DNS Storage Flags

Registration Procedure(s)

Expert Review

Expert(s)

Jim Hague, Sara Dickinson, John Dickinson

Reference

Note

In version 1.0 of C-DNS [RFC8618], there is a field describing 
attributes of the data recorded.  The field is a CBOR [RFC8949] 
unsigned integer holding bit flags.

Available Formats

CSV

Bit	Name	Description	Reference
0	anonymized-data	The data has been anonymized.	[RFC8618]
1	sampled-data	The data is sampled data.	[RFC8618]
2	normalized-names	Names in the data have been normalized.	[RFC8618]
3-63	Unassigned

C-DNS Response Flags

Registration Procedure(s)

Expert Review

Expert(s)

Jim Hague, Sara Dickinson, John Dickinson

Reference

Note

In version 1.0 of C-DNS [RFC8618], there is a field describing 
attributes of the responses recorded.  The field is a CBOR [RFC8949] 
unsigned integer holding bit flags.

Available Formats

CSV

Bit	Name	Description	Reference
0	from-cache	The Response came from cache.	[RFC8618]
1-63	Unassigned

C-DNS Address Event Types

Registration Procedure(s)

Expert Review

Expert(s)

Jim Hague, Sara Dickinson, John Dickinson

Reference

Note

In version 1.0 of C-DNS [RFC8618], there is a field identifying types 
of the events related to client addresses.  This field is a CBOR 
[RFC8949] unsigned integer.  There  is a related optional field 
"ae-code", which, if present, holds an additional CBOR unsigned 
integer giving additional information specific to the event type.

Available Formats

CSV

Identifier	Event Type	ae-code contents	Reference
0	TCP reset	None	[RFC8618]
1	ICMP time exceeded	ICMP code [icmpcodes]	[RFC8618]
2	ICMP destination unreachable	ICMP code [icmpcodes]	[RFC8618]
3	ICMPv6 time exceeded	ICMPv6 code [icmpv6codes]	[RFC8618]
4	ICMPv6 destination unreachable	ICMPv6 code [icmpv6codes]	[RFC8618]
5	ICMPv6 packet too big	ICMPv6 code [icmpv6codes]	[RFC8618]
6-18446744073709551615	Unassigned