[ https://bro-tracker.atlassian.net/browse/BIT-1156?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15726#comment-15726 ]
Vern Paxson commented on BIT-1156: ---------------------------------- Does "payload of DNS TXT records" mean that an individual TXT record can consist of multiple character strings? If so, and if the order is significant/preserved, then set[string] wouldn't be the right type. If instead this is referring to multiple TXT RRs, then likely set[string] is okay (but worth double-checking the RFC regarding the semantics for that case). > DNS analyzer parses TXT records imcompletely > -------------------------------------------- > > Key: BIT-1156 > URL: https://bro-tracker.atlassian.net/browse/BIT-1156 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Reporter: Robin Sommer > Fix For: 2.3 > > > The payload of DNS TXT records can consist of multiple character strings but > the DNS analyzer parses out only the first. We should parse them out all and > then probably concatenate into a single string to pass to the event, > separated with semicolons or something. > I have a trace with an example but it would need anonymization before > inclusion into the test suite. -- This message was sent by Atlassian JIRA (v6.2-OD-10-004-WN#6253) _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev