Vendor: SIE (1)

Type: dnsdedupe (2)


Description: A message type for capturing DNS query/response state

  • "dnsdedupe"

    A message type for representing deduplicated passive DNS
    replication RRSET data
  • "type" (enum)

         One of Insertion, Expiration, Chaff, Authoritative, Merged, Merged_Authoritative,
         or Merged_Insertion.
  • "count" (uint32)

        How many times the RRSET was seen since the last broadcast message.
  • "time_first" (uint32)

  • "time_last" (uint32)

  • "zone_time_first" (uint32)

  • "zone_time_last" (uint32)

        Over what period the data was seen in passive DNS replication or zone files.
  • "response_ip (bytes)

         The IP address of the responding nameserver
  • "rrname" (bytes)

  • "rrtype" (uint32)

  • "rrclass" (uint32)

  • "rrttl" (uint32)

  • "rdata" (uint32)

  • "response (bytes)

     The RRSET data.
  • "bailiwick" (bytes)

     The domain under which the RRSET answer was given.  For exmaple, a GTLD nameserver
     for COM might provide different answers for the same query than the delegated
     authoritative nameserrvers for FARSIGHTSECURITY.COM might provide.