On 27 October 2010 21:37, Christiano F. Haesbaert
<haesba...@haesbaert.org> wrote:
> The 0x8000 bit in a question isn't a cache flush indication.
> It's the QU bit, indicating the question accepts a unicast response,
although
> it's the same bit in the class field, they have completely different
meanings
> when in a RR or in a query.
>
> The draft refers it as the QU (Question Unicast) bit, so I've changed it to
QU.
>
> Index: print-domain.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/tcpdump/print-domain.c,v
> retrieving revision 1.17
> diff -d -u -p -w -r1.17 print-domain.c
> --- print-domain.c 27 Oct 2009 23:59:55 -0000 1.17
> +++ print-domain.c 27 Oct 2010 23:33:19 -0000
> @@ -342,7 +342,7 @@ ns_qprint(register const u_char *cp, reg
> i = EXTRACT_16BITS(cp);
> cp += 2;
> if (is_mdns && i == (C_IN|C_CACHE_FLUSH))
> - printf(" (Cache flush)");
> + printf(" (QU)");
> else if (i != C_IN)
> printf(" %s", tok2str(ns_class2str, "(Class %d)", i));
>
>
Just some more info, I've tested it on a linux box and it outputs QU
(Unicast) or QM (Multicast), I don't see a point in outputing QM as
this is the default/normal question.
