dns_zone_change.yml

name: DNS Zone Change Notification Request
description: Check that Zone change notification is parsed properly from DNS Zone
  change notification request.
requirements:
  protocols: [dns]
marks: [dns]
pcap: dns_zone_change.pcap
probe:
  protocols: [dns]
at_least_one: [dns_id, dns_flags, dns_req_query_type, dns_req_query_class, dns_req_query_name,
  dns_resp_rr.name, dns_resp_rr.type, dns_resp_rr.class, dns_resp_rr.ttl, dns_resp_rr.data,
  dns_resp_rr.flowmon_data]

flows:
  - src_ip: 192.168.3.250
    dst_ip: 192.168.74.118
    ip_version: 4
    protocol: 17
    bytes: 105
    packets: 1
    src_port: 31545
    dst_port: 53
    dns_id: 51350
    _forward:
      dns_flags: 0x2400
      dns_req_query_type: 6
      dns_req_query_class: 1
      dns_req_query_name: kkkresort.com
      dns_resp_rr:
        - name: kkkresort.com
          type: 6
          class: 1
          ttl: 0
          data: du.ac vk.me 2020865903 28880 7200 604800 86400
          flowmon_data: '0x64752E616320766B2E6D65207873F76F000070D000001C2000093A800001518'