FlowTest/testing/validation/dns_aaaa.yml at main · pascal260303/FlowTest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
name: DNS AAAA Request
description: Check that at least one of the IPv6 addresses present in DNS response
  to type AAAA request is present in the flow.
requirements:
  protocols: [dns]
marks: [dns]
pcap: dns_aaaa.pcap
probe:
  protocols: [dns]
at_least_one: [dns_id, dns_flags, dns_req_query_type, dns_req_query_class, dns_req_query_name,
  dns_resp_rcode, dns_resp_rr.name, dns_resp_rr.type, dns_resp_rr.class, dns_resp_rr.ttl,
  dns_resp_rr.data, dns_resp_rr.flowmon_data]

flows:
  - src_ip: 192.168.141.135
    dst_ip: 192.168.94.13
    ip_version: 4
    protocol: 17
    bytes: 75
    bytes@rev: 686
    packets: 1
    packets@rev: 1
    src_port: 63563
    dst_port: 53
    dns_id: 62070
    _forward:
      dns_flags: 0x0010
      dns_req_query_type: 28
      dns_req_query_class: 1
      dns_req_query_name: door2doorcargo.com
    _reverse:
      dns_flags: 0x8410
      dns_resp_rcode: 0
      dns_resp_rr:
        - name: door2doorcargo.com
          type: 28
          class: 1
          ttl: 86400
          data: fe80::189a:6d10:7f6b:349e
          flowmon_data: '0xFE80000000000000189A6D107F6B349E'
        - name: door2doorcargo.com
          type: 46
          class: 1
          ttl: 86400