DNS Answers
See original GitHub issueThere doesn’t appear to be a way to get all the IP answers sent in a DNS response.
While dns.count.answers
gives the correct number of answers, dns.a
will only return the first answer IP, rather than a list of all the answer IPs given.
Issue Analytics
- State:
- Created 6 years ago
- Comments:5
Top Results From Across the Web
DNS Response Message Format
This article analyses the DNS query response. We look at the DNS response message format and analyse it using packet sniffers.
Read more >What's in a DNS response?
The answer we're looking at here has five parts: the NAME , TTL , CLASS , TYPE and RDATA . Let's look at...
Read more >DNS Message — How to Read Query and Response ... - Carson
What needs attention in a DNS message are Questions, Answer RRs, Queries, and Answers. The first two are counts, while the other two...
Read more >The top four DNS response codes and what they mean
Every DNS query gets a response. Stay on top of your network activity with BlueCat by understanding the four most common DNS response...
Read more >Parsing DNS query and response fields
The following information can help you parse the data in the DNS Query and DNS Response fields.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Figured out how to do this. dns.a.all_fields will give you all answers in a list.
I’m curious about this as well. In a DNS response packet, how do we map a domain to an IP, when the response contains additional RRs and/or NS records? For example, since
dns.resp_name.all_fields
will list all domains (across different record types, additional RRs, NS etc.), how do we map an entry in e.g.dns.a.all_fields
,dns.aaaa.all_fields
etc. to a domain indns.resp_name.all_fields
?