Flow stats in dns_end event

Hi,

event dns_end(c: connection, msg: dns_msg)
{
print “dns_end: -------------------------------”;
print c$orig, c$resp, c$id, c$dns;
print “dns_end: -------------------------------”;
}

Output:

Yes, the "dns_end" event and associated values can get
created/enqueued before the states are updated. However, the updated
stats *are* technically available by the time the event gets
dispatched, so one trick to refresh the connection record value would
be to use "lookup_connection()". See if this helps:

event dns_end(c: connection, msg: dns_msg)
{
c = lookup_connection(c$id);
print "dns_end: -------------------------------";
print c$orig, c$resp, c$id, c$dns;
print "dns_end: -------------------------------";
}

- Jon

Awesome, thanks!

It worked.

Nabil