DNS Chain¶
This module contains the DNSChain flow analysis chain which can be used by PATHspider’s Observer for recording Domain Name System [RFC1035] details.
-
class
pathspider.chains.dns.DNSChain[source]¶ This flow analysis chain records details from Domain Name System application data.
Field Name Type Meaning dns_response_validbool The flow contained a valid DNS response -
new_flow(rec, ip)[source]¶ For a new flow, all fields will be initialised to
False.Parameters: - rec (dict) – the flow record
- ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record
Returns: Always
TrueReturn type: bool
-
tcp(rec, tcp, rev)[source]¶ Records DNS details from TCP segment.
- DNS Response
- If the packet contains a payload, an attempt is made to parse it
and if successful the
dns_response_validfield is set toTrueif it was a response (not a query).
Parameters: - rec (dict) – the flow record
- tcp – the TCP packet that was observed to be part of this flow
- rev (bool) –
Trueif the packet was in the reverse direction,Falseif in the forward direction
Returns: Falseif a valid DNS response has been seen, otherwiseTrueReturn type: bool
-
udp(rec, udp, rev)[source]¶ Records DNS details from UDP datagram.
- DNS Response
- If the packet contains a payload, an attempt is made to parse it
and if successful the
dns_response_validfield is set toTrueif it was a response (not a query).
Parameters: - rec (dict) – the flow record
- tcp – the UDP packet that was observed to be part of this flow
- rev (bool) –
Trueif the packet was in the reverse direction,Falseif in the forward direction
Returns: Falseif a valid DNS response has been seen, otherwiseTrueReturn type: bool
-