Module dns 

Available on crate feature dns only.

Passive DNS parsing (UDP/53).

Parses DNS query/response messages observed in UDP/53 traffic.

DnsUdpParser is the integration point — a DatagramParser impl yielding a typed DnsMessage stream. Pair it with the typed crate::driver::Driver (via datagram_on_ports), crate::pcap::datagram_messages, or netring’s datagram_stream. With correlation enabled (DnsUdpParser::with_correlation) it matches responses to queries — round-trip time lands in DnsResponse::elapsed, and on_tick emits DnsMessage::Unanswered for queries that time out. The Correlator is also public for advanced custom-scoped correlation.

Quick start (stateless message parsing)

use flowscope::dns::{parse_message, DnsParseResult};

let payload: &[u8] = b"";  // your UDP/53 payload
match parse_message(payload) {
    Ok(DnsParseResult::Query(q)) => println!("query: {} questions", q.questions.len()),
    Ok(DnsParseResult::Response(r)) => println!("response: rcode={:?}", r.rcode),
    Ok(_) => {}    // future variants
    Err(_e) => {}  // malformed — ignore
}

Scope

• UDP/53 only in v0.1. TCP/53 (large responses, AXFR/IXFR) and DoT (TLS/853) are deferred.
• Passive — no resolution, no validation.
• DNSSEC: RRSIG/DNSKEY surface as DnsRdata::Other with raw rdata; we don’t validate.
• Common record types decoded: A, AAAA, CNAME, NS, PTR, MX. Everything else: DnsRdata::Other { rtype, data }.

Convenience accessors

DnsQuery / DnsResponse

Field / method	Returns	Notes
id	u16	transaction ID (matches query ↔ response)
questions	Vec<DnsQuestion>	name + rtype + rclass per query slot
answers (response)	Vec<DnsRecord>	A / AAAA / CNAME / NS / PTR / MX
rcode (response)	DnsRcode	response code
elapsed (correlated response)	Option<Duration>	round-trip time

DnsFlags

Method	Returns
is_response	bool
is_authoritative	bool
is_truncated	bool
is_recursion_desired	bool
is_recursion_available	bool
opcode	u8
rcode_raw	u8

Structs

Correlator

Correlator state for query/response matching.

DnsConfig

Tunables for DNS query/response correlation (crate::dns::Correlator, crate::dns::DnsUdpParser::with_config).

DnsExchange

One DNS query + response pair.

DnsExchangeParser

DatagramParser impl that emits one DnsExchange per logical exchange.

DnsFlags

Flag/header bits from the DNS message header word.

DnsQuery

Parsed DNS query observed on the wire.

DnsQuestion

DnsRecord

One DNS resource record.

DnsResolutionCache

Per-client DNS-resolution cache with TTL eviction.

DnsResponse

Parsed DNS response.

DnsTcpParser

Per-flow DNS-over-TCP parser. Holds independent length-framed buffers for the initiator (queries) and responder (responses).

DnsUdpParser

Per-flow DNS-over-UDP parser.

NameClaim

One provenance-tagged name binding for an IP.

NameMap

Passive-DNS-grade IP → name map. See the dns module docs and NameMapConfig for tuning.

NameMapConfig

Tuning for a NameMap.

Enums

DnsMessage

Unified message type emitted by DnsUdpParser.

DnsOutcome

Outcome of an observed DNS exchange.

DnsParseResult

Outcome of parse_message.

DnsRcode

DNS response code (RFC 1035 §4.1.1, RFC 6895 for extended codes).

DnsRdata

Decoded record data for the common types we can render simply. Everything else lands in DnsRdata::Other.

Provenance

Where a name-for-IP binding came from. Distinct sources for the same IP coexist in a NameMap rather than overwriting.

Constants

PARSER_KIND_TCP

Slug returned by DnsTcpParser’s parser_kind() — the ParserKind::DnsTcp slug.

PARSER_KIND_UDP

Slug returned by DnsUdpParser’s parser_kind() — the ParserKind::DnsUdp slug.

Functions

exchanges_from_pcappcap

Iterate every aggregated DnsExchange (query + response pair) in the pcap. One event per resolution.

messages_from_pcappcap

Iterate every DnsMessage in the pcap (UDP path only), paired with the FiveTupleKey of the flow it was seen on.

parse_message

Parse one DNS UDP payload into a DnsQuery or DnsResponse.

parse_message_at

Same as parse_message but lets you set the event timestamp.