dns_nx_domain.yml

name: DNS NX Domain
description: Check that DNS response code NX domain is parsed properly.
requirements:
  protocols: [dns]
marks: [dns]
pcap: dns_nx_domain.pcap
probe:
  protocols: [dns]
at_least_one: [dns_id, dns_flags, dns_req_query_type, dns_req_query_class, dns_req_query_name,
  dns_resp_rcode]

flows:
  - src_ip: 192.168.170.56
    dst_ip: 217.13.4.24
    ip_version: 4
    protocol: 17
    bytes: 69
    bytes@rev: 69
    packets: 1
    packets@rev: 1
    src_port: 1711
    dst_port: 53
    dns_id: 30307
    _forward:
      dns_flags: 0x0100
      dns_req_query_type: 1
      dns_req_query_class: 1
      dns_req_query_name: GRIMM.utelsystems.local
    _reverse:
      dns_flags: 0x8583
      dns_resp_rcode: 3