Vendor: SIE (1)
Type: dnsdedupe (2)
Definition: http://rsfcode.isc.org/git/sie-nmsg/tree/dnsdedupe.proto
Description: A message type for capturing DNS query/response state
"dnsdedupe"
A message type for representing deduplicated passive DNS replication RRSET data
"type" (enum)
One of Insertion, Expiration, Chaff, Authoritative, Merged, Merged_Authoritative, or Merged_Insertion.
"count" (uint32)
How many times the RRSET was seen since the last broadcast message.
"time_first" (uint32)
"time_last" (uint32)
"zone_time_first" (uint32)
"zone_time_last" (uint32)
Over what period the data was seen in passive DNS replication or zone files.
"response_ip (bytes)
The IP address of the responding nameserver
"rrname" (bytes)
"rrtype" (uint32)
"rrclass" (uint32)
"rrttl" (uint32)
"rdata" (uint32)
"response (bytes)
The RRSET data.
"bailiwick" (bytes)
The domain under which the RRSET answer was given. For exmaple, a GTLD nameserver for COM might provide different answers for the same query than the delegated authoritative nameserrvers for FARSIGHTSECURITY.COM might provide.