couple of questions

Zeek
1

Hi Christian,
I had another question that should hopefully be simple.
1) In the DNS policy file there is an event for "dns_EDNS_addl" what part of the packet is this field in a DNS connection and what is the "pldsize" value from? Is there a way to break out the data from this field?
2) When a DNS record has "DNS_SEC_OK" What is that from the packet connection?

Thanks,
Jake

2

Sorry, I'm not familiar with the internals of the DNS analyzer.

Cheers,
Christian.