dnsopInternet Engineering Task Force (IETF) J. DickinsonInternet-DraftRequest for Comments: 8618 J. HagueIntended status:Category: Standards Track S. DickinsonExpires: June 15, 2019ISSN: 2070-1721 Sinodun IT T. Manderson ICANN J. BondICANN December 12, 2018 C-DNS:Wikimedia Foundation, Inc. September 2019 Compacted-DNS (C-DNS): A Format for DNS Packet CaptureFormat draft-ietf-dnsop-dns-capture-format-10Abstract This document describes a data representation for collections of DNS messages. The format is designed for efficient storage and transmission of large packet captures of DNS traffic; it attempts to minimize the size of such packet capture files but retain the full DNS message contents along with the most useful transport metadata. It is intended to assist with the development of DNStraffictraffic- monitoring applications. Status of This Memo ThisInternet-Draftissubmitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documentsan Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF).Note that other groups may also distribute working documents as Internet-Drafts. The listIt represents the consensus ofcurrent Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents validthe IETF community. It has received public review and has been approved fora maximumpublication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 ofsix monthsRFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may beupdated, replaced, or obsoleted by other documentsobtained atany time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on June 15, 2019.https://www.rfc-editor.org/info/rfc8618. Copyright Notice Copyright (c)20182019 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction. . . . . . . . . . . . . . . . . . . . . . . . 3....................................................4 2. Terminology. . . . . . . . . . . . . . . . . . . . . . . . . 5.....................................................5 3. Datacollection use cases . . . . . . . . . . . . . . . . . . 5Collection Use Cases .......................................5 4. Designconsiderations . . . . . . . . . . . . . . . . . . . . 7Considerations ...........................................8 5. Choice of CBOR. . . . . . . . . . . . . . . . . . . . . . . 9.................................................10 6. C-DNSformat conceptual overview . . . . . . . . . . . . . . 9Format Conceptual Overview ...............................10 6.1. Block Parameters. . . . . . . . . . . . . . . . . . . . 13..........................................14 6.2. Storage Parameters. . . . . . . . . . . . . . . . . . . 13........................................14 6.2.1. Optionaldata items . . . . . . . . . . . . . . . . . 14Data Items ................................15 6.2.2. Optional RRs and OPCODEs. . . . . . . . . . . . . . 15...........................16 6.2.3. Storageflags . . . . . . . . . . . . . . . . . . . . 15Flags ......................................17 6.2.4. IP Addressstorage . . . . . . . . . . . . . . . . . 16Storage .................................17 7. C-DNSformat detailed description . . . . . . . . . . . . . . 16Format Detailed Description ..............................18 7.1. MapquantitiesQuantities andindexes . . . . . . . . . . . . . . . 16Indexes ................................18 7.2. Tabularrepresentation . . . . . . . . . . . . . . . . . 17Representation ....................................18 7.3. "File". . . . . . . . . . . . . . . . . . . . . . . . . 18 7.4.....................................................19 7.3.1. "FilePreamble". . . . . . . . . . . . . . . . . . . . . 18 7.4.1......................................20 7.3.1.1. "BlockParameters". . . . . . . . . . . . . . . . . . 19 7.4.2..........................20 7.3.1.1.1. "StorageParameters" ............21 7.3.1.1.1.1. "StorageHints" ....22 7.3.1.1.2. "CollectionParameters". . . . . . . . . . . . . . . 22 7.5..........24 7.3.2. "Block". . . . . . . . . . . . . . . . . . . . . . . . . 24 7.5.1.............................................25 7.3.2.1. "BlockPreamble". . . . . . . . . . . . . . . . . . . 24 7.5.2............................26 7.3.2.2. "BlockStatistics". . . . . . . . . . . . . . . . . . 25 7.5.3..........................27 7.3.2.3. "BlockTables". . . . . . . . . . . . . . . . . . . . 26 7.6..............................28 7.3.2.3.1. "ClassType" ....................29 7.3.2.3.2. "QueryResponseSignature" .......30 7.3.2.3.3. "Question" .....................33 7.3.2.3.4. "RR" ...........................34 7.3.2.3.5. "MalformedMessageData" .........34 7.3.2.4. "QueryResponse". . . . . . . . . . . . . . . . . . . . . 32 7.6.1............................35 7.3.2.4.1. "ResponseProcessingData". . . . . . . . . . . . . . 34 7.6.2........36 7.3.2.4.2. "QueryResponseExtended". . . . . . . . . . . . . . . 34 7.7.........37 7.3.2.5. "AddressEventCount". . . . . . . . . . . . . . . . . . . 35 7.8........................38 7.3.2.6. "MalformedMessage". . . . . . . . . . . . . . . . . . . 36........................39 8. Versioning. . . . . . . . . . . . . . . . . . . . . . . . . 37.....................................................39 9. C-DNS to PCAP. . . . . . . . . . . . . . . . . . . . . . . . 37..................................................40 9.1. Namecompression . . . . . . . . . . . . . . . . . . . . 38Compression ..........................................42 10. Datacollection . . . . . . . . . . . . . . . . . . . . . . . 39Collection ...............................................42 10.1. Matchingalgorithm . . . . . . . . . . . . . . . . . . . 40Algorithm .......................................43 10.2. Messageidentifiers . . . . . . . . . . . . . . . . . . 42Identifiers ......................................45 10.2.1. Primary ID(required) . . . . . . . . . . . . . . . 42(Required) .............................45 10.2.2. Secondary ID(optional) . . . . . . . . . . . . . . 43(Optional) ...........................46 10.3. Algorithmparameters . . . . . . . . . . . . . . . . . . 43Parameters .....................................46 10.4. Algorithmrequirements . . . . . . . . . . . . . . . . . 43Requirements ...................................46 10.5. Algorithmlimitations . . . . . . . . . . . . . . . . . 43Limitations ....................................47 10.6. Workspace. . . . . . . . . . . . . . . . . . . . . . . 44................................................47 10.7. Output. . . . . . . . . . . . . . . . . . . . . . . . . 44...................................................47 10.8.Post processing . . . . . . . . . . . . . . . . . . . . 44Post-Processing ..........................................47 11. Implementationguidance . . . . . . . . . . . . . . . . . . . 44Guidance .......................................47 11.1. Optionaldata . . . . . . . . . . . . . . . . . . . . . 45Data ............................................48 11.2. Trailingbytes . . . . . . . . . . . . . . . . . . . . . 45Bytes ...........................................48 11.3. LimitingcollectionCollection of RDATA. . . . . . . . . . . . . . 45.............................49 11.4. Timestamps. . . . . . . . . . . . . . . . . . . . . . . 45...............................................49 12.Implementation status . . . . . . . . . . . . . . . . . . . . 46 12.1. DNS-STATS Compactor . . . . . . . . . . . . . . . . . . 46 13.IANAconsiderations . . . . . . . . . . . . . . . . . . . . . 47 13.1.Considerations ...........................................49 12.1. Transporttypes . . . . . . . . . . . . . . . . . . . . 47 13.2.Types ..........................................49 12.2. Datastorage flags . . . . . . . . . . . . . . . . . . . 48 13.3. Response processing flags . . . . . . . . . . . . . . . 48 13.4.Storage Flags .......................................50 12.3. Response-Processing Flags ................................51 12.4. AddressEventtypes . . . . . . . . . . . . . . . . . . . 49 14.Types .......................................51 13. Securityconsiderations . . . . . . . . . . . . . . . . . . . 49 15.Considerations .......................................52 14. Privacyconsiderations . . . . . . . . . . . . . . . . . . . 50 16. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 50 17. Changelog . . . . . . . . . . . . . . . . . . . . . . . . . . 51 18.Considerations ........................................52 15. References. . . . . . . . . . . . . . . . . . . . . . . . . 54 18.1.....................................................53 15.1. Normative References. . . . . . . . . . . . . . . . . . 54 18.2......................................53 15.2. Informative References. . . . . . . . . . . . . . . . . 55 18.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 57...................................55 Appendix A. CDDL. . . . . . . . . . . . . . . . . . . . . . . . 58..................................................58 Appendix B. DNS Namecompression example . . . . . . . . . . . . 68Compression Example ..........................69 B.1. NSDcompression algorithm . . . . . . . . . . . . . . . . 69Compression Algorithm ..................................70 B.2. Knot Authoritativecompression algorithm . . . . . . . . 70Compression Algorithm ...................70 B.3. Observeddifferences . . . . . . . . . . . . . . . . . . 70Differences .......................................71 Appendix C. Comparison of Binary Formats. . . . . . . . . . . . 70..........................71 C.1. Comparison withfullFull PCAPfiles . . . . . . . . . . . . . 73Files ............................74 C.2. Simple versusblock coding . . . . . . . . . . . . . . . 74Block Coding .................................74 C.3. Binary versustext formats . . . . . . . . . . . . . . . 74Text Formats .................................75 C.4. Performance. . . . . . . . . . . . . . . . . . . . . . . 74................................................75 C.5. Conclusions. . . . . . . . . . . . . . . . . . . . . . . 75................................................75 C.6. Blocksize choice . . . . . . . . . . . . . . . . . . . . 75Size Choice ..........................................76 Appendix D. Data Fields for Traffic Regeneration ..................77 D.1. Recommended Fields for Traffic Regeneration ................77 D.2. Issues with Small Data Captures ............................77 Acknowledgements ..................................................78 Authors' Addresses. . . . . . . . . . . . . . . . . . . . . . . 76................................................79 1. Introduction There has long been a need for server operators to collect DNSqueriesQueries andresponsesResponses on authoritative and recursive name servers for monitoring and analysis. This data is used in a number ofwaysways, including traffic monitoring, analyzing networkattacksattacks, and "day in the life" (DITL) [ditl] analysis. A wide variety of tools already exist that facilitate the collection of DNS traffic data, such asDSCthe DNS Statistics Collector (DSC) [dsc], packetq [packetq], dnscap[dnscap][dnscap], and dnstap [dnstap]. However, there is no standard exchange format for large DNS packet captures. The PCAP ("packet capture") [pcap] format orPCAP-NGthe PCAP Next Generation (PCAP-NG) [pcapng]formats areformat is typically used in practice for packet captures, but these file formats can contain a great deal of additional information that is not directly pertinent to DNS traffic analysis and thus unnecessarily increases the capture file size.AdditionallyAdditionally, these tools and formats typically have no filter mechanism to selectively record only certain fields at capture time, requiring post-processing for anonymization or pseudonymization of data to protect user privacy. There has also been work on usingtext basedtext-based formats to describe DNS packetssuch as [I-D.daley-dnsxml], [RFC8427],(for example, see [dnsxml] and [RFC8427]), butthese arethis work is largely aimed at producing convenient representations of single messages. Many DNS operators may receive hundreds of thousands ofqueriesQueries per second on a single name serverinstanceinstance, so a mechanism to minimize the storage and transmission size (and therefore upload overhead) of the data collected is highly desirable. The format described in this document, C-DNS (Compacted-DNS),focussesfocuses on the problem of capturing and storing large packet capture files of DNS traffic with the following goals in mind: o Minimize the file size for storage and transmission. o Minimize the overhead of producing the packet capture file and the cost of any further(general purpose)(general-purpose) compression of the file. This document contains: o A discussion of some common use cases in which DNS data iscollected,collected; see Section 3. o A discussion of the major design considerations in developing an efficient data representation for collections of DNSmessages,messages; see Section 4. o A description of whyCBORthe Concise Binary Object Representation (CBOR) [RFC7049] was chosen for thisformat,format; see Section 5. o A conceptual overview of the C-DNSformat,format; see Section 6. o The definition of the C-DNS format for the collection of DNSmessages,messages; see Section 7. o Notes on converting C-DNS data to PCAPformat,format; see Section 9. o Somehigh levelhigh-level implementation considerations for applications designed to produceC-DNS,C-DNS; see Section 10. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. "Packet" refers to an individual IPv4 or IPv6 packet.TypicallyTypically, packets are UDP datagrams, but such packets may also be part of a TCP data stream. "Message", unless otherwise qualified, refers to a DNS payload extracted from a UDP datagram or a TCP data stream. The parts of DNS messages are named as they are in [RFC1035]. Specifically, the DNS message has five sections: Header, Question, Answer, Authority, and Additional.Pairs of DNS messages are called a Query and a Response.3. Datacollection use casesCollection Use Cases From a purely server operator perspective, collecting full packet captures of all packets goingininto or out of a name server provides the most comprehensive picture of network activity. However, there are several design choices or other limitations that are common to many DNS installations and operators. o DNS servers are hosted in a variety of situations: * Self-hosted servers *Third partyThird-party hosting (including multiple third parties) *Third partyThird-party hardware (including multiple third parties) o Data is collected under different conditions: * On well-provisioned servers running in a steady state * On heavily loaded servers * On virtualized servers * On servers that are under DoS attack * On servers that are unwitting intermediaries in DoS attacks o Traffic can be collected via a variety of mechanisms: * Within the name server implementation itself * On the same hardware as the name server itself * Using a network tap on an adjacent host to listen to DNS traffic * Using port mirroring to listen from another host o The capabilities of data collection (and upload) networks vary: * Out-of-band networks with the same capacity as the in-band network * Out-of-band networks with less capacity than the in-band network * Everything being on the in-band network Thus, there is a wide range of usecasescases, from very limited data collection environments(third party(third-party hardware, servers that are under attack, packet capture on the name server itself and no out-of-band network) to "limitless" environments(self hosted, well provisioned(self-hosted, well-provisioned servers, using a network tap or port mirroring withanout-of-band networks with the same capacity as the in-band network). In theformer,former case, it is infeasible to reliably collect full packet captures, especially if the server is under attack. In the latter case, collection of full packet captures may be reasonable. As a result of these restrictions, the C-DNS data format is designed with the most limited use case inmindmind, such that: odataData collection will occur on the same hardware as the name server itself ocollectedCollected data will be stored on the same hardware as the name server itself, at least temporarily ocollectedCollected data being returned to some central analysis system will use the same network interface as the DNSqueriesQueries andresponsesResponses othereThere can be multiplethird partythird-party servers involved Because of these considerations, a major factor in the design of the format is minimal storage size of the capture files. Another significant consideration for any application that records DNS traffic is that the running of the name server software and the transmission of DNSqueriesQueries andresponsesResponses are the most important jobs of a name server; capturing data is not. Any data collection system co-located with the name server needs to be intelligent enough to carefully manage its CPU, disk,memorymemory, and network utilization. This leads to designing a format that requires a relatively low overhead to produce and minimizes the requirement for further potentially costly compression. However, it is also essential that interoperability with less restricted infrastructure is maintained. In particular, it is highly desirable that the collection format should facilitate there- creationre-creation of common formats (such as PCAP) that are as close to the original as isrealisticrealistic, given the restrictions above. 4. DesignconsiderationsConsiderations This section presents some of the major design considerations used in the development of the C-DNS format. 1. The basic unit of data is a combined DNS Query and the associated Response (a"Q/R"Query/Response (Q/R) data item"). The same structure will be used for unmatched Queries and Responses. Queries without Responses will be captured omitting theresponseResponse data. Responses withoutqueriesQueries will be captured omitting the Query data (but using the Question section from theresponse,Response, if present, as an identifying QNAME). * Rationale: A Query and the associated Responserepresentsrepresent the basic level of a client's interaction with the server. Also, combining the Query and Response into one item often reduces storage requirements due to commonality in the data of the two messages. In the context of generating a C-DNSfilefile, it is assumed that only those DNS payloadswhichthat can be parsed to produce a well-formed DNS message are stored in the structured Query/ Response data items of the C-DNS format and that all other messages willbe(optionally) be recorded as separate malformed messages. Parsing a well-formed messagemeans asmeans, at aminimum:minimum, the following: * The packet has a well-formed12 byte12-byte DNS Header with arecognisedrecognized OPCODE. * The section counts are consistent with the section contents. * All of theresource recordsResource Records (RRs) can be fully parsed. 2. Alltop leveltop-level fields in eachQ/RQuery/Response data item will be optional. * Rationale: Different operators will have different requirements for data to be available for analysis. Operators with minimal requirements should not have to pay the cost of recording full data, though this will limit the ability to perform certain kinds of data analysis and also to reconstruct packet captures. For example, omitting theresource recordsRRs from a Response will reduce the C-DNS file size; inprinciple responsesprinciple, Responses can be synthesized if there is enough context. Operators may have different policies for collecting user data and can choose to omit or anonymize certain fields at capturetime e.g.time, e.g., client address. 3. MultipleQ/RQuery/Response data items will be collected into blocks in the format. Common data in a block will be abstracted and referenced from individualQ/RQuery/Response data items by indexing. The maximum number ofQ/RQuery/Response data items in a block will be configurable. * Rationale: This blocking and indexing action provides a significant reduction in the volume of file data generated. Although this introduces complexity, it provides compression of the data that makes use of knowledge of the DNS message structure. * It is anticipated that the files produced can be subject to further compression usinggeneral purposegeneral-purpose compression tools. Measurements show that blocking significantly reduces the CPU required to perform such strong compression. See Appendix C.2. * Examples of commonality between DNS messages are that in most cases the QUESTION RR is the same in thequeryQuery andresponse,Response and that there is a finite set ofquery signaturesQuery "signatures" (based on a subset of attributes). For many authoritativeserversservers, there is very likely to be a finite set ofresponsesResponses that are generated, of which a large number are NXDOMAIN. 4. Traffic metadata can optionally be included in each block. Specifically, counts of some types of non-DNS packets(e.g.(e.g., ICMP, TCP resets) sent to the server may be of interest. 5. Thewire formatwire-format content of malformed DNS messages may optionally be recorded. * Rationale: Any structured capture format that does not capture the DNS payload byte for byte will be limited to some extent in that it cannot represent malformed DNS messages. Only those messages that can be fully parsed and transformed into the structured format can be fully represented. Note, however, that this can result in rather misleading statistics. For example, a malformedquery whichQuery that cannot be represented in the C-DNS format will lead to the(well formed)(well-formed) DNSresponsesResponse with error code FORMERR appearing as'unmatched'. Therefore"unmatched". Therefore, it can greatly aid downstream analysis to have the wire format of the malformed DNS messages available directly in the C-DNS file. 5. Choice of CBOR This document presents a detailed format descriptionusing CBOR, the Concise Binary Object Representation defined infor C-DNS. The format uses CBOR [RFC7049]. The choice of CBOR was made taking a number of factors into account. o CBOR is a binaryrepresentation,representation and thus is economical in storage space. o Other binary representations were investigated, and whilst all had attractive features, none had a significant advantage over CBOR. See Appendix C for some discussion of this. o CBOR is an IETF specification and is familiar to IETF participants. It is based on the now-common ideas of lists andobjects,objects and thus requires very little familiarization for those in the wider industry. o CBOR is a simpleformat,format and can easily be implemented from scratch if necessary.MoreFormats that are more complexformatsrequire librarysupportsupport, which may present problems on unusual platforms. o CBOR can also be easily converted to text formats such as JSON([RFC8259])[RFC8259] for debugging and other human inspection requirements. o CBOR data schemas can be described usingCDDL [I-D.ietf-cbor-cddl].the Concise Data Definition Language (CDDL) [RFC8610]. 6. C-DNSformat conceptual overviewFormat Conceptual Overview The following figures show purely schematic representations of the C-DNS format to convey the high-level structure of the C-DNS format. Section 7 provides a detailed discussion of the CBOR representation and individual elements. Figure 1 shows the C-DNS format at the toplevellevel, including the file header and data blocks. The Query/Response data items, Address/Event Count dataitemsitems, and Malformed Message data items link to various Blocktables.Tables. +-------+ + C-DNS | +-------+--------------------------+ | Filetype identifierType Identifier | +----------------------------------+ | FilepreamblePreamble | | +--------------------------------+ | | Formatversion infoVersion | | +--------------------------------+ | | BlockparametersParameters | +-+--------------------------------+ | Block | | +--------------------------------+ | | BlockpreamblePreamble | | +--------------------------------+ | | BlockstatisticsStatistics | | +--------------------------------+ | | BlocktablesTables | | +--------------------------------+ | | Query/Response data items | | +--------------------------------+ | | Address/Event Count data items | | +--------------------------------+ | | Malformed Message data items | +-+--------------------------------+ | Block | | +--------------------------------+ | | BlockpreamblePreamble | | +--------------------------------+ | | BlockstatisticsStatistics | | +--------------------------------+ | | BlocktablesTables | | +--------------------------------+ | | Query/Response data items | | +--------------------------------+ | | Address/Event Count data items | | +--------------------------------+ | | Malformed Message data items | +-+--------------------------------+ | Further Blocks... | +----------------------------------+ Figure 1: The C-DNSformat.Format Figure 2 shows somemore detailedmore-detailed relationships within eachblock,Block, specifically those between the Query/Response data item and the relevant Blocktables.Tables. Some fields have been omitted for clarity. +----------------+ | Query/Response | +-------------------------+ | TimeoffsetOffset | +-------------------------+ +------------------+ | Clientaddress |------------>|Address |---------+->| IPaddressAddress array | +-------------------------+ | +------------------+ | ClientportPort | | +-------------------------+ | +------------------+ | Transaction ID |+------>|+---)->| Name/RDATA array|<------+|<--------+ +-------------------------+ | | +------------------+ | | QuerysignatureSignature |--+ | | | +-------------------------+ | | | +-----------------+ | | ClienthoplimitHoplimit (q) |+--)------>|+--)---)->| Query Signature | | +-------------------------+ |+-----------------+------+| +-----------------+-------+ | | ResponsedelayDelay (r) | ||+--| ServeraddressAddress | | +-------------------------+ |+------------------------++-------------------------+ | | QuerynameName |--+--+ | ServerportPort | | +-------------------------+ |+------------------------++-------------------------+ | | QuerysizeSize (q) | | | TransportflagsFlags | | +-------------------------+ |+------------------------++-------------------------+ | | ResponsesizeSize (r) | | | QRtypeType | | +-------------------------+ |+------------------------++-------------------------+ | | ResponseprocessingProcessing (r) | | | QRsignature flagsSignature Flags | | | +-----------------------+ |+------------------------++-------------------------+ | | | Bailiwickindex|--+ | Query OPCODE (q) | | | +-----------------------++------------------------++-------------------------+ | | | Flags | | QR DNSflagsFlags | | +-+-----------------------++------------------------++-------------------------+ | | Extraquery infoQuery Info (q) | | Query RCODE (q) | | | +-----------------------++------------------------++-------------------------+ | | | Question |--+---+ +--+-Query Class/Type (q) | | | +-----------------------+ | |+------------------------++-------------------------+ | | | Answer |--+ | | | QueryQD countQDCOUNT (q) | | | +-----------------------+ | | |+------------------------++-------------------------+ | | | Authority |--+ | | | QueryAN countANCOUNT (q) | | | +-----------------------+ | | |+------------------------++-------------------------+ | | | Additional |--+ | | | QueryNS countNSCOUNT (q) | | +-+-----------------------+ | | |+------------------------++-------------------------+ | | Extraresponse infoResponse Info (r) | |-+ | | | QueryEDNS versionARCOUNT (q) | | | +-----------------------+ | | | |+------------------------++-------------------------+ | | | Answer |--+ | | | | Query EDNSUDP sizeversion (q) | | | +-----------------------+ | | | |+------------------------++-------------------------+ | | | Authority |--+ | | | | QueryOpt RDATAEDNS UDP Size (q) | | | +-----------------------+ | | | |+------------------------++-------------------------+ | | | Additional |--+ | | | |Response RCODE (r)Query OPT RDATA (q) |--+ +-+-----------------------+ | |+-+-----------------------+| +-------------------------+ | |+------------------------+| | | Response RCODE (r) | | | | | +-------------------------+ | + -----------------------------+ | +----------+ | | | | | | + -----------------------------+ | | | | +---------------+ +----------+ | | | +->| QuestionlistList |->| Question | | | | | array | | array | | | | +---------------+ +----------+--+ | | | | Name|--+------)------------------+|--+-----)--------------------+ | +-------------+ | | +------------+ | |Class/type |--)---+--+->|Class/Type |--)---+-+->| Class/Type | | +-------------+ | | | array | | | | +------------+--+ | | | |ClassCLASS | | +---------------+ +----------+ | | +---------------+ +--->| RRlistList array |->| RR array | | | |TypeTYPE | +---------+-----+ +----------+--+ | | +---------------+ | Name |--+ | +-------------+ | |Class/typeClass/Type |------+ +-------------+ Figure 2: The Query/Responsedata itemData Item andsubsidiary tables.Subsidiary Tables In Figure22, data items annotated (q) are only present when aquery/ responseQuery/Response has aquery,Query, and those annotated (r) are only present when aquery/response responseQuery/Response Response is present. A C-DNS file begins with a file header containing a File Type Identifier and a File Preamble. The File Preamble contains information on the file Format Version and an array of Block Parameters items (the contents of which include Collection and Storage Parameters used for one or moreblocks).Blocks). The file header is followed by a series ofdataBlocks. A Block consists of a Block Preamble item, some Block Statistics for the traffic stored within theBlockBlock, and then various arrays of common data collectively called the Block Tables. This is then followed by an array of the Query/Response data items detailing thequeriesQueries andresponsesResponses stored within the Block. The array of Query/Response data items is in turn followed by the Address/EventCountsCount data items (an array of per-client counts of particular IP events) and then Malformed Message data items (an array of malformed messages that are stored in the Block). The exact nature of the DNS data will affect whatblockBlock size is the bestfit, howeverfit; however, sample data for a root server indicated thatblockBlock sizes up to 10,000Q/RQuery/Response data items give good results. See Appendix C.6 for more details. This design exploits data commonality andblock basedblock-based storage tominimiseminimize the C-DNS file size. As aresultresult, C-DNS cannot be streamed below the level of ablock.Block. 6.1. Block Parameters The details of the Block Parameters items are not shown in the diagrams but are discussed here for context. An array of Block Parameters items is stored in the File Preamble (with a minimum of one item at index 0); a Block Parameters item consists of a collection of Storage and Collection Parameters that applies to any given Block. An array is used in order to support use cases such as wanting to merge C-DNS files from different sources. The Block Preamble item then contains an optional index for the Block Parameters item that applies for that Block; if notpresentpresent, the index defaults to 0. Hence, in effect, a global Block Parameters item is definedwhichthat can then be overridden per Block. 6.2. Storage Parameters The Block Parameters item includes a Storage Parameters item--- this contains information about the specific data fields stored in the C-DNS file. These parameters include: o The sub-second timing resolution used by the data. o Information (hints) on which optional data are omitted. See Section 6.2.1. o Recorded OPCODES [opcodes] and RRtypesTYPEs [rrtypes]. See Section 6.2.2. o Flags indicating, for example, whether the data is sampled or anonymized. SeeSectionSections 6.2.3 andSection 15.14. o Client and server IPv4 and IPv6 address prefixes. See Section6.2.46.2.4. 6.2.1. Optionaldata itemsData Items To enable implementations to store data to their precise requirements in as space-efficient a manner as possible, all fields in the following arrays are optional: o Query/Response o Query Signature o MalformedmessagesMessages In other words, an implementation can choose to omit any data item that is not required for its usecase.case (whilst observing the restrictions relating to IP address storage described in Section 6.2.4). In addition, implementations may be configured to not record allRRs,RRs or to only record messages with certain OPCODES. This does, however, mean that a consumer of a C-DNS file faces two problems: 1. How can it quickly determine if a file definitely does not contain the data items it requires to complete a particular task(e.g.(e.g., reconstructingqueryDNS traffic or performing a specific piece of data analysis)? 2. How can it determineifwhether a data item is not present because itwas: *was (1) explicitly not recorded or* the data item was(2) notavailable/present.available/present? For example, capturing C-DNS data from within anameservername server implementation makes it unlikely that the Client Hoplimit can be recorded. Or, if there is noquery ARCountQuery ARCOUNT recorded and noqueryQuery OPT RDATA [RFC6891] recorded, is that because noqueryQuery contained an OPT RR, or because that data was not stored? The Storage Parameters item therefore also contains a Storage Hintsitemitem, which specifies which items the encoder of the file omits from the stored data and will therefore never be present. (This approach is taken because a flag that indicated which items were included for collection would not guarantee that the item waspresent,present -- only that it might be.) An implementation decoding that file can then use these flags to quickly determine whether the input data is not rich enough for its needs. One scenario where this may be particularly important is the case of regenerating traffic. It is possible to collect such a small set of data items that an implementation decoding the file cannot determine if a given Query/Response data item was generated from just a Query, just a Response, or a Query/Response pair. This makes it impossible to reconstruct DNS traffic even if sensible defaults are provided for the missing data items. This is discussed in more detail in Section 9. 6.2.2. Optional RRs and OPCODEs Also included in the Storage Parameters item are explicit arrays listing the RRtypesTYPEs and the OPCODEs to be recorded. These arrays remove any ambiguity overwhetherwhether, for example, messages containing particular OPCODEsorare not present becausethey(1) certain OPCODEs did notoccur,occur orbecause(2) the implementation is not configured to record them. In the case of OPCODEs, for a message to be fully parsable, the OPCODE must be known to the collecting implementation. Any message with an OPCODE unknown to the collecting implementation cannot be validated as correctlyformed,formed and so must be treated as malformed. Messages with OPCODES known to the recording application but not listed in the Storage Parameters item are discarded by the recording application during C-DNS capture (regardless of whether they are malformed or not). In the case ofRR records,RRs, each record in a message must be fully parsable, including parsing the record RDATA, as otherwise the message cannot be validated as correctly formed. Any RRrecordwith an RRtypeTYPE not known to the collecting implementation cannot be validated as correctlyformed,formed and so must be treated as malformed. Once a message is correctly parsed, an implementation is free to record only a subset of theRR recordsRRs present. 6.2.3. StorageflagsFlags The Storage Parameters item contains flags that can be used to indicate if: o the data is anonymized, o the data is produced from sample data, or o names in the data have been normalized (converted to uniform case). The Storage Parameters item also contains optional fields holding details of the sampling method used and the anonymization method used. It is RECOMMENDED that these fields contain URIs [RFC3986] pointing to resources describing the methods used. See Section1514 for further discussion of anonymization and normalization. 6.2.4. IP AddressstorageStorage The format can store either full IP addresses or just IPprefixes,prefixes; the Storage Parameters item contains fields to indicate if only IP prefixes were stored. If the IP address prefixes are absent, then full addresses are stored. In thiscasecase, the IP version can be directly inferred from the stored address length and the fields "qr-transport-flags" inQueryResponseSignatureQueryResponseSignature, "ae-transport-flags" in AddressEventCount, and "mm-transport-flags" in MalformedMessageData (which contain the IP version bit) are optional. If IP address prefixes are given, only the prefix bits of addresses are stored. In thiscasecase, in order to determine the IP version, the fields "qr-transport-flags" inQueryResponseSignatureQueryResponseSignature, "ae-transport- flags" in AddressEventCount, and "mm-transport-flags" in MalformedMessageData MUST bepresent, so that the IP version can be determined.present. SeeSection 7.5.3.2Sections 7.3.2.3.2 andSection 7.5.3.5.7.3.2.3.5. As an example of storing only IP prefixes, if a client IPv6 prefix of 48 is specified, a client address of 2001:db8:85a3::8a2e:370:7334 will be stored as 0x20010db885a3, reducing address storage space requirements. Similarly, if a client IPv4 prefix of 16 is specified, a client address of 192.0.2.1 will be stored as 0xc000 (192.0). 7. C-DNSformat detailed descriptionFormat Detailed Description The CDDL definition for the C-DNS format is given in Appendix A. 7.1. MapquantitiesQuantities andindexesIndexes All map keys are integers with values specified in the CDDL. String keys would significantly bloat the file size. All key values specified are positive integers under 24, so their CBOR representation is a single byte. Positive integer values not currently used as keys in a map are reserved for use in future standard extensions. Implementations may choose to add additional implementation-specific entries to any map. Negative integer map keys are reserved for these values. Key values from -1 to -24 also have asingle bytesingle-byte CBOR representation, so such implementation-specific extensions are not at any space efficiency disadvantage. An item described as an index is the index of the data item in the referenced array. Indexes are 0-based. 7.2. TabularrepresentationRepresentation The following sections present the C-DNS specification in tabular format with a detailed description of each item. In all quantities that contain bit flags, bit 0 indicates the least significant bit,i.e.i.e., flag "n" in quantity "q" is on if "(q & (1 << n)) != 0". For the sake of readability, all type and field names defined in the CDDL definition are shown in double quotes. Type names are by convention camel case(e.g. "BlockTable"),(e.g., "BlockTables"), and field names arelower- caselowercase with hyphens(e.g.(e.g., "block-tables"). For the sake of brevity, the following conventions are used in the tables: o The column M marks whether items in a map are mandatory. * X - Mandatory items. * C - Conditionally mandatoryitem.items. Such items are usually optional but may be mandatory in some configurations. * If the column is empty, the item is optional. o The column T gives the CBORdata typedatatype of the item. * U - Unsignedintegerinteger. * I - Signed integer(i.e.(i.e., either a CBOR unsigned integer or a CBOR negativeinteger)integer). * B -BooleanBoolean. * S - Bytestringstring. * T - Textstringstring. * M -MapMap. * A -ArrayArray. In the case of maps and arrays, more information on the type of each value,includeincluding the CDDL definition name if applicable, is given in the description. 7.3. "File" A C-DNS file has an outer structure "File",a mapan array that contains the following: +---------------+---+---+-------------------------------------------+ | Field | M | T | Description | +---------------+---+---+-------------------------------------------+ | file-type-id | X | T | String "C-DNS" identifying the file type. | | | | | | | file-preamble | X | M | Version and parameter information for the | | | | | whole file. Map of type"FilePreamble","FilePreamble"; | | | | | see Section7.4.7.3.1. | | | | | | | file-blocks | X | A | Array of items of type"Block","Block"; see | | | | | Section7.5.7.3.2. The array may be empty if | | | | | the file contains no data. | +---------------+---+---+-------------------------------------------+7.4.7.3.1. "FilePreamble" Information about data in the file. A map containing the following: +----------------------+---+---+------------------------------------+ | Field | M | T | Description | +----------------------+---+---+------------------------------------+ | major-format-version | X | U | Unsigned integer'1'."1". The major | | | | | version of the format used infile.the | | | | | file. See Section 8. | | | | | | | minor-format-version | X | U | Unsigned integer'0'."0". The minor | | | | | version of the format used infile.the | | | | | file. See Section 8. | | | | | | | private-version | | U | Version indicator available for | | | | | private use by implementations. | | | | | | | block-parameters | X | A | Array of items of type | | | | |"BlockParameters", see"BlockParameters". See Section | | | | |7.4.1.7.3.1.1. The array must containat| | | | | at least one entry. (The"block-| | | | |parameters-index""block-parameters-index" item ineach| | | | | each "BlockPreamble" indicateswhich| | | | | which array entry applies to that | | | | | "Block".) | +----------------------+---+---+------------------------------------+7.4.1.7.3.1.1. "BlockParameters" Parameters relating to data storage and collectionwhichthat apply to one or more items of type "Block". A map containing the following: +-----------------------+---+---+-----------------------------------+ | Field | M | T | Description | +-----------------------+---+---+-----------------------------------+ | storage-parameters | X | M | Parameters relating to data | | | | | storage in a "Block" item. Map | | | | | of type"StorageParameters","StorageParameters"; see | | | | | Section7.4.1.1.7.3.1.1.1. | | | | | | | collection-parameters | | M | Parameters relating to collection | | | | | of the data in a "Block" item. | | | | | Map of type | | | | |"CollectionParameters","CollectionParameters"; see | | | | | Section7.4.2.7.3.1.1.2. | +-----------------------+---+---+-----------------------------------+7.4.1.1.7.3.1.1.1. "StorageParameters" Parameters relating to how data is stored in the items of type "Block". A map containing the following: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | ticks-per-second | X | U | Sub-second timing is recorded in | | | | | ticks. This specifies the number of | | | | | ticks in a second. | | | | | | | max-block-items | X | U | The maximum number of items stored in | | | | | any of the arrays in a "Block" item | | | | |(Q/R items, address event counts(Q/R, Address/Event Count, or | | | | |malformed messages).Malformed Message data items). Anindication to| | | | | indication to a decoder of theresources needed to| | | | | resources needed to process the file. | | | | | | | storage-hints | X | M | Collection of hints as to which fields | | | | | are omitted in the arrays that have | | | | | optional fields. Map of type | | | | |"StorageHints", see"StorageHints". See Section7.4.1.1.1.| | | | | 7.3.1.1.1.1. | | | | | | | opcodes | X | A | Array of OPCODES [opcodes] (unsigned | | | | | integers, each in the range 0 to 15 | | | | | inclusive) recorded by thecollectioncollecting | | | | | implementation. See Section 6.2.2. | | | | | | | rr-types | X | A | Array of RRtypesTYPEs [rrtypes] (unsigned | | | | | integers, each in the range 0 to 65535 | | | | | inclusive) recorded by thecollectioncollecting | | | | | implementation. See Section 6.2.2. | | | | | | | storage-flags | | U | Bit flags indicating attributes of | | | | | stored data. | | | | | Bit 0. 1 if the data has been | | | | | anonymized. | | | | | Bit 1. 1 if the data is sampled data. | | | | | Bit 2. 1 if the names have been | | | | | normalized (converted to uniform | | | | | case). | | | | | | | client-address | | U | IPv4 client address prefix length, in | | -prefix-ipv4 | | | the range 1 to 32 inclusive. If | | | | | specified, only the address prefix | | | | | bits are stored. | | | | | | | client-address | | U | IPv6 client address prefix length, in | | -prefix-ipv6 | | | the range 1 to 128 inclusive. If | | | | | specified, only the address prefix | | | | | bits are stored. | | | | | | | server-address | | U | IPv4 server address prefix length, in | | -prefix-ipv4 | | | the range 1 to 32 inclusive. If | | | | | specified, only the address prefix | | | | | bits are stored. | | | | | | | server-address | | U | IPv6 server address prefix length, in | | -prefix-ipv6 | | | the range 1 to 128 inclusive. If | | | | | specified, only the address prefix | | | | | bits are stored. | | | | | | | sampling-method | | T | Information on the sampling method | | | | | used. See Section 6.2.3. | | | | | | | anonymization | | T | Information on the anonymization | | -method | | | method used. See Section 6.2.3. | +------------------+---+---+----------------------------------------+7.4.1.1.1.7.3.1.1.1.1. "StorageHints" An indicator of which fields the collecting implementation omits in the maps with optional fields. Note that hints have a top-down precedence. In other words, where a map contains another map, the hint on the containing map overrides any hints in the contained map and the contained map is omitted. A map containing the following: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | query-response | X | U | Hints indicating which "QueryResponse" | | -hints | | | fields arecandidates for capture or | | | | | omitted,omitted; seesectionSection7.6. If a| | | | | 7.3.2.4. If a bit is unset, the fieldis omitted| | | | | is omitted from the capture. | | | | | Bit 0. time-offset | | | | | Bit 1. client-address-index | | | | | Bit 2. client-port | | | | | Bit 3. transaction-id | | | | | Bit 4. qr-signature-index | | | | | Bit 5. client-hoplimit | | | | | Bit 6. response-delay | | | | | Bit 7. query-name-index | | | | | Bit 8. query-size | | | | | Bit 9. response-size | | | | | Bit 10. response-processing-data | | | | | Bit 11. query-question-sections | | | | | Bit 12. query-answer-sections | | | | | Bit 13. query-authority-sections | | | | | Bit 14. query-additional-sections | | | | | Bit 15. response-answer-sections | | | | | Bit 16. response-authority-sections | | | | | Bit 17. response-additional-sections | | | | | | | query-response | X | U | Hints indicating which | | -signature-hints | | | "QueryResponseSignature" fields are | | | | |candidates for capture or omitted,omitted; see| | | | | sectionSection7.5.3.2.7.3.2.3.2. If abit is| | | | | bit is unset, the field is omittedfrom the| | | | | from the capture. | | | | | Bit 0.server-addressserver-address-index | | | | | Bit 1. server-port | | | | | Bit 2. qr-transport-flags | | | | | Bit 3. qr-type | | | | | Bit 4. qr-sig-flags | | | | | Bit 5. query-opcode | | | | | Bit 6.dns-flagsqr-dns-flags | | | | | Bit 7. query-rcode | | | | | Bit 8.query-class-typequery-classtype-index | | | | | Bit 9. query-qdcount | | | | | Bit 10. query-ancount | | | | | Bit 11. query-nscount | | | | | Bit 12. query-arcount | | | | | Bit 13. query-edns-version | | | | | Bit 14. query-udp-size | | | | | Bit 15.query-opt-rdataquery-opt-rdata-index | | | | | Bit 16. response-rcode | | | | | | | rr-hints | X | U | Hints indicating which optional "RR" | | | | | fields arecandidates for capture oromitted; see Section | | | | |omitted, see Section 7.5.3.4.7.3.2.3.4. If a bit is unset, the | | | | |is unset, thefield is omitted from| | | | |the capture. | | | | | Bit 0. ttl | | | | | Bit 1. rdata-index | | other-data-hints | X | U | Hints indicating which otherdatadatatypes | | | | |typesare omitted. If a bit is unset, the | | | | |the the data typedatatype is omitted from the| | | | |capture. | | | | | Bit 0. malformed-messages | | | | | Bit 1. address-event-counts | +------------------+---+---+----------------------------------------+7.4.2.7.3.1.1.2. "CollectionParameters" Parameters providing informationtoregarding how data in the file was collected (applicable for some, but notallall, collection environments). The values are informational only and serve ashintsmetadata to downstreamanalysersanalyzers as to the configuration of a collecting implementation. They can provide context when interpreting what data ispresent/ absentpresent/absent from the capture but cannot necessarily be validated against the data captured. These parameters have no default. If they do not appear, nothing can be inferred about their value. A map containing the following items: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | query-timeout | | U | To be matched with aquery,Query, aresponseResponse | | | | | must arrive within this number of | | | | |seconds.milliseconds. | | | | | | | skew-timeout | | U | The network stack may report a | | | | |responseResponse before the corresponding | | | | |query.Query. AresponseResponse is not consideredto| | | | | to be missing aqueryQuery until after this | | | | | manymicro-seconds.microseconds. | | | | | | | snaplen | | U | Collect up to this many bytes per | | | | | packet. | | | | | | | promisc | | B | "true" if promiscuous mode | | | | | [pcap-options] was enabled on the | | | | | interface, "false" otherwise. | | | | | | | interfaces | | A | Array of identifiers (of type text | | | | | string) of the interfaces used for | | | | | collection. | | | | | | | server-addresses | | A | Array of server collection IP | | | | | addresses (of type byte string).Hint| | | | | Metadata for downstreamanalysers; does notanalyzers; | | | | | does not affect collection. | | | | | | | vlan-ids | | A | Array of identifiers (of type unsigned | | | | | integer, each in the range 1 to 4094 | | | | | inclusive) of VLANs [IEEE802.1Q] | | | | | selected for collection. VLAN IDs are | | | | | unique only within an administrative | | | | | domain. | | | | | | | filter | | T | Filter for input, in "tcpdump"[pcap-filter] style filter| | | | |for input.[pcap-filter] style. | | | | | | | generator-id | | T |Implementation specificImplementation-specific human-readable | | | | | string identifying the collection | | | | | method. | | | | | | | host-id | | T | String identifying the collecting | | | | | host.Empty if converting an existing | | | | | packet capture file.| +------------------+---+---+----------------------------------------+7.5.7.3.2. "Block" Container for data with common collection and storage parameters. A map containing the following: +--------------------+---+---+--------------------------------------+ | Field | M | T | Description | +--------------------+---+---+--------------------------------------+ | block-preamble | X | M | Overall information for the "Block" | | | | | item. Map of type"BlockPreamble","BlockPreamble"; | | | | | see Section7.5.1.7.3.2.1. | | | | | | | block-statistics | | M | Statistics about the "Block" item. | | | | | Map of type"BlockStatistics","BlockStatistics"; see | | | | | Section7.5.2.7.3.2.2. | | | | | | | block-tables | | M | The arrays containing data | | | | | referenced by individual | | | | | "QueryResponse" or | | | | | "MalformedMessage" items. Map of | | | | | type"BlockTables","BlockTables"; see Section | | | | |7.5.3.7.3.2.3. | | | | | | | query-responses | | A | Details of individualDNSC-DNS Q/R data | | | | | items. Array of items of type | | | | |"QueryResponse","QueryResponse"; see Section7.6. If| | | | | 7.3.2.4. If present, the array mustnot be| | | | | not be empty. | | | | | | | address-event | | A |Per clientPer-client counts of ICMP messages | | -counts | | | and TCP resets. Array of items of | | | | | type"AddressEventCount","AddressEventCount"; see | | | | | Section7.7.7.3.2.5. If present, thearray| | | | | array must not be empty. | | | | | | | malformed-messages | | A | Details of malformed DNS messages. | | | | | Array of items of type | | | | |"MalformedMessage","MalformedMessage"; see Section7.8.| | | | | 7.3.2.6. If present, the array mustnot be| | | | | not be empty. | +--------------------+---+---+--------------------------------------+7.5.1.7.3.2.1. "BlockPreamble" Overall information for a "Block" item. A map containing the following: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | earliest-time | C | A | A timestamp(2(two unsigned integers, of | | | | | type "Timestamp") for the earliestrecord| | | | | record in the "Block" item. The firstinteger| | | | | integer is the number of seconds sincethe| | | | | the POSIX epoch [posix-time]("time_t"),| | | | | ("time_t"), excluding leap seconds.The second| | | | | The second integer is the number ofticks (see| | | | | ticks (see Section7.4.1.1)7.3.1.1.1) sincethe start of| | | | | the start of the second. This fieldis mandatory| | | | | is mandatory unless all block itemscontaining a| | | | | containing a time offset from thestart of the| | | | |blockstart of the Block also omit that time | | | | | offset. | | | | | | | block-parameters | | U | The index of the item in the"block-| | -index | | |parameters""block-parameters" array (in the"file-| | | | |premable""file-preamble" item) applicable tothis| | | | | this block. If not present, index 0is| | | | | is used. See Section7.4.1.7.3.1. | +------------------+---+---+----------------------------------------+7.5.2.7.3.2.2. "BlockStatistics" Basic statistical information about a "Block" item. A map containing the following: +---------------------+---+---+-------------------------------------+ | Field | M | T | Description | +---------------------+---+---+-------------------------------------+ | processed-messages | | U | Total number of well-formed DNSmessages| | | | | messages processed from the inputtraffic| | | | | traffic stream during collection ofdata in| | | | | data in this "Block" item. | | | | | | | qr-data-items | | U | Total number of Q/R data items in | | | | | this "Block" item. | | | | | | | unmatched-queries | | U | Number of unmatchedqueriesQueries in this | | | | | "Block" item. | | | | | | | unmatched-responses | | U | Number of unmatchedresponsesResponses in | | | | | this "Block" item. | | | | | | | discarded-opcode | | U | Number of DNS messages processed | | | | | from the input traffic stream | | | | | during collection of data in this | | | | | "Block" item but not recorded | | | | | because their OPCODE is not in the | | | | | list to be collected. | | | | | | | malformed-items | | U | Number of malformed messagesfound| | | | |inprocessed from the inputfortraffic | | | | | stream during collection of data in | | | | | this "Block" item. | +---------------------+---+---+-------------------------------------+7.5.3.7.3.2.3. "BlockTables" Map of arrays containing data referenced by individual "QueryResponse" or "MalformedMessage" items in this "Block". Each element is an arraywhich,that, if present, must not be empty. An item in the "qlist" array contains indexes to values in the "qrr" array. Therefore, if "qlist" is present, "qrr" must also be present. Similarly, if "rrlist" is present, "rr" must also be present. The map contains the following items: +-------------------+---+---+---------------------------------------+ | Field | M | T | Description | +-------------------+---+---+---------------------------------------+ | ip-address | | A | Array of IP addresses, in network | | | | | byte order (of type byte string). If | | | | | client or server address prefixes are | | | | | set, only the address prefix bits are | | | | | stored. Each string is therefore up | | | | | to 4 bytes long for an IPv4 address, | | | | | or up to 16 bytes long for an IPv6 | | | | | address. See Section7.4.1.1.7.3.1.1.1. | | | | | | | classtype | | A | Array of RRclassCLASS andtypeTYPE | | | | | information. Type is"ClassType", see"ClassType". | | | | | See Section7.5.3.1.7.3.2.3.1. | | | | | | | name-rdata | | A | Array where each entry is the | | | | | contents of a single NAME or RDATA in | | | | | wire format (of type byte string). | | | | | Note that NAMEs, and labels within | | | | | RDATA contents, are full domain names | | | | | or labels; no[RFC1035]name compression (per | | | | |compression[RFC1035]) is used on the individual | | | | | names/labels within the format. | | | | | | | qr-sig | | A | Array of Q/R data item signatures.Type| | | | | Type is"QueryResponseSignature", see"QueryResponseSignature". | | | | | See Section7.5.3.2.7.3.2.3.2. | | | | | | | qlist | | A | Array of type "QuestionList". A | | | | | "QuestionList" is an array of | | | | | unsigned integers, indexes to | | | | | "Question" items in the "qrr" array. | | | | | | | qrr | | A | Array of type "Question". Each entry | | | | | is the contents of a singlequestion,Question, | | | | | where aquestionQuestion is the second or | | | | | subsequentquestionQuestion in aquery.Query. See | | | | | Section7.5.3.3.7.3.2.3.3. | | | | | | | rrlist | | A | Array of type "RRList". An "RRList" | | | | | is an array of unsigned integers, | | | | | indexes to "RR" items in the "rr" | | | | | array. | | | | | | | rr | | A | Array of type "RR". Each entry isthe| | | | | the contents of a single RR. SeeSection| | | | |7.5.3.4.Section 7.3.2.3.4. | | | | | | | malformed-message | | A | Array of the contents of malformed | | -data | | | messages. Array of type | | | | |"MalformedMessageData", see"MalformedMessageData". See Section | | | | |7.5.3.5.7.3.2.3.5. | +-------------------+---+---+---------------------------------------+7.5.3.1.7.3.2.3.1. "ClassType" RRclassCLASS andtypeTYPE information. A map containing the following: +-------+---+---+--------------------------+ | Field | M | T | Description | +-------+---+---+--------------------------+ | type | X | U | TYPE value [rrtypes]. | | | | | | | class | X | U | CLASS value [rrclasses]. | +-------+---+---+--------------------------+7.5.3.2.7.3.2.3.2. "QueryResponseSignature" Elements of a Q/R data item that are often common between multiple individual Q/R data items. A map containing the following: +--------------------+---+---+--------------------------------------+ | Field | M | T | Description | +--------------------+---+---+--------------------------------------+ | server-address | | U | The index in theitem in the "ip-"ip-address" array | | -index | | |address" arrayof the server IP address. See | | | | |address. SeeSection7.5.3.7.3.2.3. | | | | | | | server-port | | U | The server port. | | | | | | | qr-transport-flags | C | U | Bit flags describing the transport | | | | | used to service thequery.Query. Same | | | | | definition as "mm-transport-flags" | | | | | in Section7.5.3.5,7.3.2.3.5, with an | | | | | additional indicator for trailing | | | | |bytes, seebytes. See Appendix A. | | | | | Bit 0. IP version. 0 if IPv4, 1 if | | | | | IPv6. See Section 6.2.4. | | | | |BitBits 1-4. Transport.4 bit unsigned4-bit | | | | | unsigned value where | | | | | 0 =UDP,UDP [RFC1035] | | | | | 1 =TCP,TCP [RFC1035] | | | | | 2 = TLS [RFC7858] | | | | |TLS,3 = DTLS[RFC7858],[RFC8094] | | | | | 4 =DoHHTTPS [RFC8484] | | | | | 15 = Non-standard transport (see | | | | | below) | | | | |[RFC8484].Values5-155-14 are reserved for future | | | | |for futureuse. | | | | | Bit 5. 1 if trailing bytes inqueryQuery | | | | | packet. See Section 11.2. | | | | | | | qr-type | | U | Type of Query/Responsetransaction.transaction | | | | | based on the definitions in the | | | | | dnstap schema [dnstap-schema]. | | | | | 0 = Stub. Aquery fromtransaction between a | | | | | stub resolver and a DNS server from | | | | | the perspective of the stub | | | | | resolver. | | | | | 1 = Client.An incoming query toA transaction between a | | | | | client and a DNS server (a proxy or | | | | | full recursiveresolver.resolver) from the | | | | | perspective of the DNS server. | | | | | 2 = Resolver. Aquery sent from atransaction between | | | | | a recursive resolvertoand anauthorative| | | | | authoritative server from the | | | | | perspective of the recursive | | | | | resolver. | | | | | 3 =Authorative.Authoritative. Aquery totransaction | | | | | between a recursive resolver and an | | | | |authorative resolver.authoritative server from the | | | | | perspective of the authoritative | | | | | server. | | | | | 4 = Forwarder. Aquery sent fromtransaction | | | | | between a downstream forwarder and | | | | |recursive resolver toan upstream DNS server (a recursive | | | | |recursive resolver.resolver) from the perspective of | | | | | the downstream forwarder. | | | | | 5 = Tool. Aquery sent totransaction between aserver| | | | |byDNS software tool and aserverDNS server, | | | | | from the perspective of the tool. | | | | | | | qr-sig-flags | | U | Bit flags explicitly indicating | | | | | attributes of the message pair | | | | | represented by this Q/R data item | | | | | (not all attributes may be recorded | | | | | or deducible). | | | | | Bit 0. 1 if a Query was present. | | | | | Bit 1. 1 if a Response was present. | | | | | Bit 2. 1 if a Query was present and | | | | | it had an OPTResource Record.RR. | | | | | Bit 3. 1 if a Response was present | | | | | and it had an OPTResource Record.RR. | | | | | Bit 4. 1 if a Query was present but | | | | | had no Question. | | | | | Bit 5. 1 if a Response was present | | | | | but had no Question (only onequery-| | | | |name-indexquery-name-index is stored per Q/R | | | | | data item). | | | | | | | query-opcode | | U | Query OPCODE. | | | | | | | qr-dns-flags | | U | Bit flags with values from the Query | | | | | and Response DNS flags. Flag values | | | | | are 0 if the Query or Response is | | | | | not present. | | | | | Bit 0. Query Checking Disabled | | | | | (CD). | | | | | Bit 1. Query Authenticated Data | | | | | (AD). | | | | | Bit 2. Query reserved (Z). | | | | | Bit 3. Query Recursion Available | | | | | (RA). | | | | | Bit 4. Query Recursion Desired | | | | | (RD). | | | | | Bit 5. Query TrunCation (TC). | | | | | Bit 6. Query Authoritative Answer | | | | | (AA). | | | | | Bit 7. Query DNSSEC answer OK (DO). | | | | | Bit 8. Response Checking Disabled | | | | | (CD). | | | | | Bit 9. Response Authenticated Data | | | | | (AD). | | | | | Bit 10. Response reserved (Z). | | | | | Bit 11. Response RecursionAvailable| | | | | Available (RA). | | | | | Bit 12. Response Recursion Desired | | | | | (RD). | | | | | Bit 13. Response TrunCation (TC). | | | | | Bit 14. Response Authoritative | | | | | Answer (AA). | | | | | | | query-rcode | | U | Query RCODE. If the Query contains | | | | | an OPT RR [RFC6891], this value | | | | | incorporates any EXTENDED-RCODE | | | | |EXTENDED_RCODE_VALUEvalue [rcodes]. | | | | | | | query-classtype | | U | The indexto the itemin thethe"classtype" array | | -index | | |"classtype" arrayof the CLASS and| | | | |TYPE of the firstQuestion. See| | | | | Question. See Section7.5.3.7.3.2.3. | | | | | | |query-qd-countquery-qdcount | | U | The QDCOUNT in the Query, or | | | | | Response if no Query present. | | | | | | |query-an-countquery-ancount | | U | Query ANCOUNT. | | | | | | |query-ns-countquery-nscount | | U | Query NSCOUNT. | | | | | | |query-ar-countquery-arcount | | U | Query ARCOUNT. | | | | | | |edns-versionquery-edns-version | | U | The Query EDNS version. ("EDNS" | | | | | stands for Extension Mechanisms for | | | | | DNS.) | | | | |udp-buf-size| | query-udp-size | | U | The Query EDNS sender's UDP payload | | | | | size. | | | | | | |opt-rdata-indexquery-opt-rdata | | U | The index in the "name-rdata" array | | -index | | | of the OPT RDATA. See Section7.5.3.| | | | | 7.3.2.3. | | | | | | | response-rcode | | U | Response RCODE. If the Response | | | | | contains an OPT RR [RFC6891], thisvalue| | | | | value incorporates any EXTENDED- | | | | |EXTENDED_RCODE_VALUERCODE value [rcodes]. | +--------------------+---+---+--------------------------------------+7.5.3.3.Version 1.0 of C-DNS supports transport values corresponding to DNS transports defined in IETF Standards Track documents at the time of writing. There are numerous non-standard methods of sending DNS messages over various transports using a variety of protocols, but they are out of scope for this document. With the current specification, these can be generically stored using value 15 (Non-standard transport), or implementations are free to use the negative integer map keys to define their own mappings. Such non-standard transports may also be the subject of a future extension to the specification. 7.3.2.3.3. "Question" Details on individual Questions in a Question section. A map containing the following: +-----------------+---+---+-----------------------------------------+ | Field | M | T | Description | +-----------------+---+---+-----------------------------------------+ | name-index | X | U | The index in the "name-rdata" array of | | | | | the QNAME. See Section7.5.3.7.3.2.3. | | | | | | | classtype-index | X | U | The index in the "classtype" array of | | | | | the CLASS and TYPE of the Question.See| | | | | See Section7.5.3.7.3.2.3. | +-----------------+---+---+-----------------------------------------+7.5.3.4.7.3.2.3.4. "RR" Details on individualResource RecordsRRs in RR sections. A map containing the following: +-----------------+---+---+-----------------------------------------+ | Field | M | T | Description | +-----------------+---+---+-----------------------------------------+ | name-index | X | U | The index in the "name-rdata" array of | | | | | the NAME. See Section7.5.3.7.3.2.3. | | | | | | | classtype-index | X | U | The index in the "classtype" array of | | | | | the CLASS and TYPE of the RR. See | | | | | Section7.5.3.7.3.2.3. | | | | | | | ttl | | U | The RR Time to Live. | | | | | | | rdata-index | | U | The index in the "name-rdata" array of | | | | | the RR RDATA. See Section7.5.3.7.3.2.3. | +-----------------+---+---+-----------------------------------------+7.5.3.5.7.3.2.3.5. "MalformedMessageData" Details on malformedmessage itemsDNS messages stored in this "Block" item. A map containing the following: +--------------------+---+---+--------------------------------------+ | Field | M | T | Description | +--------------------+---+---+--------------------------------------+ | server-address | | U | The index in the "ip-address" array | | -index | | | of the server IP address. See | | | | | Section7.5.3.7.3.2.3. | | | | | | | server-port | | U | The server port. | | | | | | | mm-transport-flags | C | U | Bit flags describing the transport | | | | | used to service thequery, seeQuery. See | | | | | Section 6.2.4. | | | | |Bit 0. IP version.Bits 1-4. Transport. 4-bit | | | | | unsigned value where | | | | | 0if IPv4,= UDP [RFC1035] | | | | | 1if= TCP [RFC1035] | | | | |IPv62 = TLS [RFC7858] | | | | |Bit 1-4. Transport. 4 bit unsigned3 = DTLS [RFC8094] | | | | |value where 0 = UDP, 1 = TCP, 24 = HTTPS [RFC8484] | | | | |TLS, 3 = DTLS [RFC7858], 415 =DoHNon-standard transport | | | | |[RFC8484].Values5-155-14 are reserved for future | | | | |for futureuse. | | | | | | | mm-payload | | S | The payload (raw bytes) of the DNS | | | | | message. | +--------------------+---+---+--------------------------------------+7.6.7.3.2.4. "QueryResponse" Details on individual Q/R data items. Note that there is no requirement that the elements of the"query- responses""query-responses" array are presented in strict chronological order. A map containing the following items: +----------------------+---+---+------------------------------------+ | Field | M | T | Description | +----------------------+---+---+------------------------------------+ | time-offset | | U | Q/R timestamp as an offset in | | | | | ticks (see Section7.4.1.1)7.3.1.1.1) from | | | | | "earliest-time". The timestamp is | | | | | the timestamp of the Query, or the | | | | | Response if there is no Query. | | | | | | | client-address-index | | U | The index in the "ip-address" | | | | | array of the client IP address. | | | | | See Section7.5.3.7.3.2.3. | | | | | | | client-port | | U | The client port. | | | | | | | transaction-id | | U | DNS transaction identifier. | | | | | | | qr-signature-index | | U | The index in the "qr-sig" array of | | | | | the "QueryResponseSignature" item. | | | | | See Section7.5.3.7.3.2.3. | | | | | | | client-hoplimit | | U | The IPv4 TTL or IPv6 Hoplimit from | | | | | the Query packet. | | | | | | | response-delay | | I | The time difference between Query | | | | | and Response, inticks (seeticks. See | | | | | Section7.4.1.1).7.3.1.1.1. Only presentif| | | | | if there is aqueryQuery and aresponse.| | | | | Response. The delay can be | | | | | negative if the network | | | | |networkstack/capture library returns | | | | |returnspackets out of order. | | | | | | | query-name-index | | U | The index in the "name-rdata" | | | | | array of the item containing the | | | | | QNAME for the first Question. See | | | | | Section7.5.3.7.3.2.3. | | | | | | | query-size | | U | DNSqueryQuery message size (see | | | | | below). | | | | | | | response-size | | U | DNSresponseResponse message size (see | | | | | below). | | | | | | | response-processing | | M | Data onresponseResponse processing. Map | | -data | | | of type"ResponseProcessingData","ResponseProcessingData". | | | | |seeSee Section7.6.1.7.3.2.4.1. | | | | | | | query-extended | | M | Extended Query data. Map of type | | | | |"QueryResponseExtended", see"QueryResponseExtended". See | | | | | Section7.6.2.7.3.2.4.2. | | | | | | | response-extended | | M | Extended Response data. Map of | | | | | type"QueryResponseExtended", see"QueryResponseExtended". See | | | | | Section7.6.2.7.3.2.4.2. | +----------------------+---+---+------------------------------------+ The "query-size" and "response-size" fields hold the DNS message size. ForUDPUDP, this is the size of the UDP payload that contained the DNS message. ForTCPTCP, it is the size of the DNS message as specified in the two-byte message length header. Trailing bytes in UDPqueriesQueries are routinely observed in traffic to authoritativeserversservers, and this value allows a calculation of how many trailing bytes were present.7.6.1.7.3.2.4.1. "ResponseProcessingData" Information on the server processing that produced theresponse.Response. A map containing the following: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | bailiwick-index | | U | The index in the "name-rdata" array of | | | | | the owner name for theresponseResponse | | | | | bailiwick. See Section7.5.3.7.3.2.3. | | | | | | | processing-flags | | U | Flags relating toresponseResponse processing. | | | | | Bit 0. 1 if theresponseResponse came from | | | | | cache. | +------------------+---+---+----------------------------------------+7.6.2.7.3.2.4.2. "QueryResponseExtended" Extended data on the Q/R data item. Each item in the map is present only if collection of the relevant details is configured. A map containing the following items: +------------------+---+---+----------------------------------------+ | Field | M | T | Description | +------------------+---+---+----------------------------------------+ | question-index | | U | The index in the "qlist" array of the | | | | | entry listing any second and | | | | | subsequent Questions in the Question | | | | | section for the Query or Response.See| | | | | See Section7.5.3.7.3.2.3. | | | | | | | answer-index | | U | The index in the "rrlist" array of the | | | | | entry listing the AnswerResourceRR sections | | | | |Record sectionsfor the Query or Response. See | | | | |Response. SeeSection7.5.3.7.3.2.3. | | | | | | | authority-index | | U | The index in the "rrlist" array of the | | | | | entry listing the AuthorityResourceRR | | | | |Recordsections for the Query or Response. | | | | |Response.See Section7.5.3.7.3.2.3. | | | | | | | additional-index | | U | The index in the "rrlist" array of the | | | | | entry listing the AdditionalResourceRR | | | | |Recordsections for the Query or Response. | | | | |Response.See Section7.5.3.7.3.2.3. Note that Query | | | | |QueryOPT RR data canbeoptionally be stored | | | | |storedin the QuerySignature. | +------------------+---+---+----------------------------------------+7.7.7.3.2.5. "AddressEventCount" Counts of variousIP relatedIP-related events relating to traffic with individual client addresses. A map containing the following:+------------------+---+---+----------------------------------------++--------------------+---+---+--------------------------------------+ | Field | M | T | Description |+------------------+---+---+----------------------------------------++--------------------+---+---+--------------------------------------+ | ae-type | X | U | The type of event. The following | | | | |eventsevent types are currently defined: | | | | | 0. TCP reset. | | | | | 1. ICMP time exceeded. | | | | | 2. ICMP destination unreachable. | | | | |3. ICMPv6 time exceeded.3. ICMPv6 time exceeded. | | | | | 4. ICMPv6 destination unreachable. | | | | | 5. ICMPv6 packet too big. | | | | | | | ae-code | | U | A code relating to the event. For | | | | | ICMP or ICMPv6 events, this MUST be | | | | | the ICMP [RFC0792] or ICMPv6 | | | | | [RFC4443] code. For other events, | | | | | the contents are undefined. | | | | | | | ae-transport-flags | C | U | Bit flags describing the transport | | | | | used to service the event. See | | | | | Section 6.2.4. | | | | | Bit 0. IP version. 0 if IPv4, 1 if | | | | | IPv6. | | | | | Bits 1-4. Transport. 4-bit | | | | | unsigned value where | | | |4. ICMPv6 destination unreachable.| 0 = UDP [RFC1035] | | | |5. ICMPv6 packet too big.| 1 = TCP [RFC1035] | | | | | 2 = TLS [RFC7858] |ae-code| |U|A code relating to the event. For ICMP| 3 = DTLS [RFC8094] | | | |or ICMPv6 events, this MUST be the| 4 = HTTPS [RFC8484] | | | |ICMP [RFC0792] or ICMPv6 [RFC4443]| 15 = Non-standard transport | | | |code. For other events the contents| Values 5-14 are reserved for future | | | | |are undefined.use. | | | | | | | ae-address-index | X | U | The index in the "ip-address" arrayof| | | | | of the client address. See Section7.5.3.| | | | | 7.3.2.3. | | | | | | | ae-count | X | U | The number of occurrences of this | | | | | event during theblockBlock collection | | | | | period. |+------------------+---+---+----------------------------------------+ 7.8.+--------------------+---+---+--------------------------------------+ 7.3.2.6. "MalformedMessage" Detailsof malformed messages.on Malformed Message data items. A map containing the following: +----------------------+---+---+------------------------------------+ | Field | M | T | Description | +----------------------+---+---+------------------------------------+ | time-offset | | U | Message timestamp as an offset in | | | | | ticks (see Section7.4.1.1)7.3.1.1.1) from | | | | | "earliest-time". | | | | | | | client-address-index | | U | The index in the "ip-address" | | | | | array of the client IP address. | | | | | See Section7.5.3.7.3.2.3. | | | | | | | client-port | | U | The client port. | | | | | | | message-data-index | | U | The index in the "malformed- | | | | | message-data" array of the message | | | | | data for this message. SeeSection| | | | |7.5.3.Section 7.3.2.3. | +----------------------+---+---+------------------------------------+ 8. Versioning The C-DNSfile preambleFile Preamble includes a fileformat version;Format Version; a major and minor version number are required fields.TheThis document defines version 1.0 of the C-DNS specification. This section describes the intended use of these version numbers in future specifications. It is noted that version 1.0 includes many optionalfields and thereforefields; therefore, consumers of version 1.0 should be inherently robust to parsing files with variable data content. Within a major version, a new minor version MUST be a strict superset of the previous minor version, with no semantic changes to existing fields. New keys MAY be added to existing maps, and new maps MAY be added. A consumer capable of reading a particular major.minor version MUST also be capable of reading all previous minor versions of the same major version. It SHOULD also be capable of parsing all subsequent minorversionsversions, ignoring any keys or maps that it does notrecognise.recognize. A new major version indicates changes to the format that are not backwards compatible with previous major versions. A consumer capable of only reading a particular major version (greater than 1) isnotneither requiredto and has no expectationnor expected to be capable of reading a previous major version. 9. C-DNS to PCAP It is usually possible tore-constructreconstruct PCAP files from the C-DNS format in a lossy fashion. Some of the issues with reconstructing both the DNS payload and the full packet stream are outlined here. The reconstruction of well-formed DNS messages depends onwhethertwo factors: 1. Whether or not a particular subset of the optional fields were captured in the C-DNS file, specifically the data fields necessary to reconstruct a valid IP header and DNS payload for both Query and Response (see Appendix D.1). Clearly, if not all these data fields were captured, the reconstruction is likely to be imperfect even if reasonable defaults are provided for the reconstruction. 2. Whether or not at least one field was captured that unambiguously identifies the Query/Response data item as containing just a Query, just a Response, or a Query/Response pair. Obviously, the qr-sig-flags defined in Section 7.3.2.3.2 is such a field; however, this field is optional. For more details, see Appendix D.2. It is noted again that simply having hints that indicate that certain data fields were not omitted does not guarantee that those data fields were actually captured. Therefore, the ability to reconstruct PCAP data (in theoptional sectionsabsence ofboth the query and response weredefaults) can in principle vary for each record captured inthea C-DNSfile. Clearly, if they were not all captured, the reconstruction will be imperfect.file, and between Blocks that have differing hints. Even if all sections of theresponseResponse were captured, one cannot reconstruct the DNSresponseResponse payloadexactlyexactly, due to the fact that some DNS names in the message on the wire may have been compressed. Section 9.1 discusses thisisin more detail. Some transport information is not captured in the C-DNS format. For example, the following aspects of the original packet stream cannot bere-constructedreconstructed from the C-DNS format: o IP fragmentation o TCP stream information: * Multiple DNS messages may have been sent in a single TCP segment * A DNS payload may have been split across multiple TCP segments * Multiple DNS messages may have been sent on a single TCP session o TLS session information: * TLS version or cipher suites * TLS-related features such as TCP Fast Open (TFO) [RFC7413] or TLS session resumption [RFC5077] o DNS-over-HTTPS [RFC8484] message details: * Whether the message used POST or GET * HTTPS Headers o Malformed DNS messages if the wire format is not recorded o AnyNon-DNSnon-DNS messages that were in the original packetstream e.g.stream, e.g., ICMP Simple assumptions can be made on the reconstruction: fragmented and DNS-over-TCP messages can be reconstructed into singlepacketspackets, and a single TCP session can be constructed for each TCP packet. Additionally, if malformed messages andNon-DNSnon-DNS packets are captured separately, they can be merged with packet captures reconstructed from C-DNS to produce a more complete packet stream. 9.1. NamecompressionCompression All the names stored in the C-DNS format are full domain names; no[RFC1035]name compression (per [RFC1035]) is used on the individual names within the format.ThereforeTherefore, when reconstructing a packet, name compression must be used in order to reproduce theon the wireon-the-wire representation of the packet.[RFC1035] nameName compression per [RFC1035] works by substituting trailing sections of a name with a reference back to the occurrence of those sections earlier in the message. Not all name server software uses the same algorithm when compressing domain names within theresponses.Responses. Some attempt maximum recompression at the expense of runtime resources, others use heuristics to balance compression andspeedspeed, and others use different rules for what is a valid compression target. This means thatresponsesResponses to the samequestionQuery from different name server softwarewhichthat match in terms of DNS payload content (header, counts, RRs with name compression removed) do not necessarily matchbyte-for-bytebyte for byte on the wire. Therefore, it is not possible to ensure that the DNSresponseResponse payload is reconstructedbyte-for-bytebyte for byte from C-DNS data. However, it can at least, in principle, be reconstructed to have the correct payload length (since the originalresponseResponse length is captured) if there is enough knowledge of the commonly implemented name compression algorithms. For example, a simplistic approach would be to try each algorithm in turn to see if it reproduces the original length, stopping at the first match. This would not guarantee that the correct algorithm has beenusedused, as it is possible to match the length whilst still not matching theon the wire bytes but,on-the-wire bytes; however, without further information added to the C-DNS data, this is the best that can be achieved. Appendix B presents an example of two different compression algorithms used by well-known name server software. 10. DatacollectionCollection This section describes a non-normative proposed algorithm for the processing of a captured stream of DNSqueriesQueries andresponsesResponses and production of a stream ofquery/responseQ/R data items, matchingqueries/ responsesQueries and Responses where possible. For the purposes of this discussion, it is assumed that the input has beenpre-processedpreprocessed such that: 1. All IP fragmentation reassembly, TCP stream reassembly, and so on,hashave already been performed. 2. Each message is associated with transport metadata required to generate the Primary ID (see Section 10.2.1). 3. Each message has a well-formed DNSheaderHeader of 12bytesbytes, and (if present) the first Question in the Question section can be parsed to generate the Secondary ID (see below). As noted earlier, this requirement can result in a malformedqueryQuery being removed in thepre-processingpreprocessing stage, but the correctly formedresponseResponse with RCODE of FORMERR being present. DNS messages are processed in the order they are delivered to the implementation. It should be noted that packet capture libraries do not necessarily provide packets in strict chronological order. This can, for example, arise on multi-core platforms where packets arriving at a network device are processed by different cores. On systems where thisbehaviourbehavior has been observed, the timestamps associated with each packet are consistent;queriesQueries always have a timestamp prior to theresponseResponse timestamp. However, the order in which these packets appear in the packet capture stream is not necessarily strictly chronological; aresponseResponse can appear in the capture stream before thequeryQuery that provoked theresponse.Response. For this discussion, thisnon- chronologicalnon-chronological delivery is termed "skew". In the presence of skew,a responseResponse packets can arrive for matching before the correspondingquery.Query. To avoid generating false instances ofresponsesResponses without a matchingquery,Query, andqueriesQueries without a matchingresponse,Response, the matching algorithm must takeaccount ofthe possibility ofskew.skew into account. 10.1. MatchingalgorithmAlgorithm A schematic representation of the algorithm for matching Q/R data items is shown in Figure 3. It takes individual DNSqueryQuery orresponseResponse messages as input, and it outputs matched Q/R data items. The numbers in the figure identify matching operations listed in Table 1. Specific details of thealgorithm,algorithm -- forexampleexample, queues,timerstimers, andidentifiers,identifiers -- are given in the following sections. .----------------------. | Process next message |<------------------+ `----------------------' | | | +------------------------------+ | | Generate message identifiers | | +------------------------------+ | | | Response | Query | +--------------< >---------------+ | | | | +--------------------+ +--------------------+ | | Find earliest QR | | Create QR item[2](2) | | | item in OFIFO[1](1) | +--------------------+ | +--------------------+ | | | +---------------+ | Match | No match | Append new QR | | +--------< >------+ | item to OFIFO | | | | +---------------+ | +-----------+ +--------+ | | | Update QR | | Add to | +-------------------+ | | item[3](3) | | RFIFO | | Find earliest QR | | +-----------+ +--------+ | item in RFIFO[1](1) | | | | +-------------------+ | +-----------------+ | | | | | | +----------------+ Match | No match | | | Remove R |-------< >-----+ | | | from RFIFO[3](3) | | | | +----------------+ | | | | | | +--------------+-----------------------+ | | | +----------------------------------------------+ | | Update alltimed outtimed-out (QT) OFIFO QR items[4](4) | | +----------------------------------------------+ | | | +--------------------------------+ | | Remove alltimed outtimed-out (ST) R | | | from RFIFO, create QR item[5](5) | | +--------------------------------+ | ____________________|_______________________ | / / | / Remove all consecutive done entries from /-------+ / front of OFIFO for further processing / /____________________________________________/ OFIFO = output FIFO containing Q/R data items (Section 10.6) RFIFO = Response FIFO containing unmatched Response items (Section 10.6) QT = Query Timeout (Section 10.3) ST = Skew Timeout (Section 10.3) Figure 3: Query/Responsematching algorithm +-----+-------------------------------------------+Matching Algorithm +-----------+-------------------------------------------+ |RefReference | Operation |+-----+-------------------------------------------++-----------+-------------------------------------------+ |[1](1) | Find earliest QR item in FIFO where: | | | * QR.done = false | | | * QR.Q.PrimaryID == R.PrimaryID | | | and, if both QR.Q and R have SecondaryID: | | | * QR.Q.SecondaryID == R.SecondaryID | | | | |[2](2) | Set: | | | QR.Q := Q | | | QR.R := nil | | | QR.done := false | | | | |[3](3) | Set: | | | QR.R := R | | | QR.done := true | | | | |[4](4) | Set: | | | QR.done := true | | | | |[5](5) | Set: | | | QR.Q := nil | | | QR.R := R | | | QR.done := true |+-----+-------------------------------------------++-----------+-------------------------------------------+ Table 1: OperationsusedUsed in thematching algorithmMatching Algorithm 10.2. MessageidentifiersIdentifiers 10.2.1. Primary ID(required)(Required) A Primary ID is constructed for each message. It is composed of the following data: 1. Source IP Address 2. Destination IP Address 3. Source Port 4. Destination Port 5. Transport 6. DNS Message ID 10.2.2. Secondary ID(optional)(Optional) If present, the first Question in the Question section is used as asecondarySecondary ID for each message. Note that there may bewell formedwell-formed DNSqueriesQueries that have a QDCOUNT of 0, and someresponsesResponses may have a QDCOUNT of 0 (for example,responsesResponses with RCODE=FORMERR or NOTIMP). In thiscasecase, thesecondarySecondary ID is not used in matching. 10.3. AlgorithmparametersParameters 1. Querytimeout, QT.Timeout (QT). AqueryQuery arrives with timestamp t1. If noresponseResponse matching thatqueryQuery has arrived before other input arrives timestamped later than (t1 + QT), aquery/responseQ/R data item containing only aquery itemQuery is recorded. Thequery timeoutQT value is typicallyofon the order of 5 seconds. 2. Skewtimeout, ST.Timeout (ST). AresponseResponse arrives with timestamp t2. If aresponseResponse has not been matched by aqueryQuery before input arrives timestamped later than (t2 + ST), aquery/responseQ/R data item containing only aresponseResponse is recorded. Theskew timeoutST value is typically a few microseconds. 10.4. AlgorithmrequirementsRequirements The algorithm is designed to handle the following input data: 1. MultiplequeriesQueries with the same Primary ID (but different Secondary ID) arriving before anyresponsesResponses for thesequeriesQueries are seen. 2. MultiplequeriesQueries with the same Primary and Secondary ID arriving before anyresponsesResponses for thesequeriesQueries are seen. 3. Queries for which no laterresponseResponse can be found within the specified timeout. 4. Responses for which no previousqueryQuery can be found within the specified timeout. 10.5. AlgorithmlimitationsLimitations For cases 1 and 2 listed in the above requirements, it is not possible to unambiguously matchqueriesQueries withresponses.Responses. This algorithm chooses to match to the earliestqueryQuery with the correct Primary and Secondary ID. 10.6. Workspace The algorithm employs two FIFO queues: oOFIFO,OFIFO: an output FIFO containing Q/R data items in chronologicalorder,order. oRFIFO,RFIFO: a FIFO holdingresponsesResponses without a matchingqueryQuery in order of arrival. 10.7. Output The output is a list of Q/R data items. Both the Query and Response elements are optional in theseitems, thereforeitems; therefore, Q/R data items have one of three types of content: 1. A matched pair ofqueryQuery andresponseResponse messages 2. AqueryQuery message with noresponseResponse 3. AresponseResponse message with noqueryQuery The timestamp of a list item is that of thequeryQuery for cases 1 and 2 and that of theresponseResponse for case 3. 10.8.Post processingPost-Processing When ending a capture, all items in theresponses FIFORFIFO are timed out immediately, generatingresponse-onlyResponse only entries to theQ/R data item FIFO.OFIFO. These and all other remaining entriesin the Q/R data item FIFOin the OFIFO should be treated astimed out queries.timed-out Queries. 11. ImplementationguidanceGuidance Whilst this document makes no specific recommendations with respect toCanonical CBOR"Canonical CBOR" (see Section 3.9 of[RFC7049])[RFC7049]), the following guidance may be of use toimplementors.implementers. Adherence to the first two rules given in Section 3.9 of [RFC7049] willminimiseminimize file sizes. Adherence to the last two rules given in Section 3.9 of [RFC7049] for all maps and arrays would unacceptably constrainimplementations,implementations -- for example, in the use case of real-time data collection in constrained environments where outputtingblock tablesBlock Tables afterquery/responseQ/R data items and allowingindefinite lengthindefinite-length maps and arrays could reduce memory requirements. It is recommended that implementations that have fundamental restrictions on what data fields they can collect SHOULD always store hints with the bits unset for those fields, i.e., they unambiguously indicate that those data fields will be omitted from captured C-DNS. 11.1. OptionaldataData When decoding C-DNSdatadata, some of the items required for a particular function that the consumer wishes to perform may be missing. Consumers should consider providing configurable default values to be used in place of the missing values in their output. 11.2. TrailingbytesBytes A DNSqueryQuery message in a UDP or TCP payload can be followed by some additional (spurious) bytes, which are not stored in C-DNS. When DNS traffic is sent over TCP, each message is prefixed with atwo bytetwo-byte lengthfieldfield, which gives the message length, excluding thetwo bytetwo-byte length field. In this context, trailing bytes can occur in twocircumstancescircumstances, with different results: 1. The number of bytes consumed by fully parsing the message is less than the number of bytes given in the length field(i.e.(i.e., the length field is incorrect and too large). In this case, the surplus bytes are considered trailing bytes inan analogousa manner analogous to UDP and recorded as such. If only this caseoccursoccurs, it is possible to process a packet containing multiple DNS messages where one or morehashave trailing bytes. 2. There are surplus bytes between the end of a well-formed message and the start of the length field for the next message. In thiscasecase, the first of the surplus bytes will be processed as the first byte of the next length field, and parsing will proceed from there, almost certainly leading to the next and any subsequent messages in the packet being considered malformed. This will not generate atrailing bytestrailing-bytes record for the processed well-formed message. 11.3. LimitingcollectionCollection of RDATA Implementations should consider providing a configurable maximum RDATA size forcapture,captures -- for example, to avoid memory issues when confronted with largeXFRzone transfer records. 11.4. Timestamps The preamble to each block includes a timestamp of the earliest record in theblock.Block. As described in Section7.5.1,7.3.2.1, the timestamp is an array of2two unsigned integers. The first is a POSIX "time_t" [posix-time]. Consumers of C-DNS should be aware ofthisthis, as it excludes leap seconds and therefore may cause minor anomalies in thedata e.g.data, e.g., when calculatingqueryQuery throughput.13.12. IANAconsiderationsConsiderations IANAis requested to createhas created a registry "C-DNS DNS Capture Format" containing the subregistries defined insections Section 13.1Sections 12.1 toSection 13.412.4 inclusive. In all cases, new entries may be added to the subregistries by Expert Review as defined in [RFC8126]. Experts are expected to exercise their own expertjudgement,judgment and should consider the following general guidelines in addition to any provided guidelinesgiventhat are particular to a subregistry. o There should be a real and compelling use for any new value. o Values assigned should be carefully chosen tominimiseminimize storage requirements for common cases.13.1.12.1. TransporttypesTypes IANAis requested to createhas created a registry "C-DNS Transports" of C-DNS transport type identifiers. The primary purpose of this registry is to provide unique identifiers for all transports used for DNSqueries.Queries. The following note is included in this registry: "In version 1.0 of C-DNS[[this RFC]],[RFC8618], there is a field to identify the type of DNS transport. This field is 4 bits in size." The initial contents of the registry are asfollows - see sections Section 7.5.3.2follows. See Sections 7.3.2.3.2, 7.3.2.3.5, andSection 7.5.3.57.3.2.5 of[[this RFC]]: +------------+------------+--------------+this document: +------------+------------------------+-----------+ | Identifier | Name | Reference |+------------+------------+--------------++------------+------------------------+-----------+ | 0 | UDP |[[this RFC]]RFC 8618 | | 1 | TCP |[[this RFC]]RFC 8618 | | 2 | TLS |[[this RFC]]RFC 8618 | | 3 | DTLS |[[this RFC]]RFC 8618 | | 4 |DoHHTTPS |[[this RFC]]RFC 8618 | |5-155-14 | Unassigned | |+------------+------------+--------------+| 15 | Non-standard transport | RFC 8618 | +------------+------------------------+-----------+ Expert reviewers should take the followingpointspoint into consideration:oIs the requested DNS transport described by a Standards Track RFC?13.2.12.2. Datastorage flagsStorage Flags IANAis requested to createhas created a registry "C-DNS Storage Flags" of C-DNS data storage flags. The primary purpose of this registry is to provide indicators giving hints on processing of the data stored. The following note is included in this registry: "In version 1.0 of C-DNS[[this RFC]],[RFC8618], there is a field describing attributes of the data recorded. The field is a CBOR [RFC7049] unsigned integer holding bit flags." The initial contents of the registry are asfollows - see sectionfollows. See Section7.4.1.17.3.1.1.1 of[[this RFC]]:this document: +------+------------------+-----------------------------+-----------+ | Bit | Name | Description | Reference | +------+------------------+-----------------------------+-----------+ | 0 |anonymised-dataanonymized-data | The data has been |[[thisRFC 8618 | | | | anonymized. | | | | |anonymised.|RFC]]| | 1 | sampled-data | The data is sampled data. |[[thisRFC 8618 | | | | |RFC]]| | 2 | normalized-names | Names in the data have been |[[thisRFC 8618 | | | | normalized. |RFC]]| | | | | | | 3-63 | Unassigned | | | +------+------------------+-----------------------------+-----------+13.3. Response processing flags12.3. Response-Processing Flags IANAis requested to createhas created a registry "C-DNS Response Flags" of C-DNSresponseresponse- processing flags. The primary purpose of this registry is to provide indicators giving hints on the generation of a particularresponse.Response. The following note is included in this registry: "In version 1.0 of C-DNS[[this RFC]],[RFC8618], there is a field describing attributes of theresponsesResponses recorded. The field is a CBOR [RFC7049] unsigned integer holding bit flags." The initial contents of the registry are asfollows - see sectionfollows. See Section7.6.17.3.2.4.1 of[[this RFC]]: +------+------------+-------------------------------+--------------+this document: +------+------------+-------------------------------+-----------+ | Bit | Name | Description | Reference |+------+------------+-------------------------------+--------------++------+------------+-------------------------------+-----------+ | 0 | from-cache | TheresponseResponse came from cache. |[[this RFC]]RFC 8618 | | 1-63 | Unassigned | | |+------+------------+-------------------------------+--------------+ 13.4.+------+------------+-------------------------------+-----------+ 12.4. AddressEventtypesTypes IANAis requested to createhas created a registry "C-DNS Address Event Types" of C-DNS AddressEvent types. The primary purpose of this registry is to provide unique identifiers of different types of C-DNS addressevents,events and so specify the contents of the optional companion field "ae-code" for each type. The following note is included in this registry: "In version 1.0 of C-DNS[[this RFC]],[RFC8618], there is a fieldidentifyidentifying types of the events related to client addresses. This field is a CBOR [RFC7049] unsigned integer. There is a related optional field "ae-code", which, if present, holds an additional CBOR unsigned integer giving additional information specific to the event type." The initial contents of the registry are asfollows - see sectionfollows. See Section7.7: +------------+----------------------+-------------------+-----------+7.3.2.5 of this document: +------------------------+---------------+--------------+-----------+ | Identifier | Event Type | ae-codecontents| Reference |+------------+----------------------+-------------------+-----------+| | | Contents | | +------------------------+---------------+--------------+-----------+ | 0 | TCP reset | None |[[thisRFC 8618 | | | | |RFC]]| | 1 | ICMP timeexceeded| ICMP code |[[thisRFC 8618 | | | exceeded | [icmpcodes] |RFC]]| | | | | | | 2 | ICMP | ICMP code | RFC 8618 | | | destination |ICMP code[icmpcodes] | | | | unreachable | | | | | | | | | 3 | ICMPv6 time | ICMPv6 code | RFC 8618 | | | exceeded | [icmp6codes] |[[this| | |unreachable|[icmpcodes]|RFC]]| |34 | ICMPv6time exceeded| ICMPv6 code |[[thisRFC 8618 | | | destination | [icmp6codes] |RFC]]| |4|ICMPv6 destinationunreachable |ICMPv6 code|[[this| | |unreachable|[icmp6codes]|RFC]]| | 5 | ICMPv6 packettoo| ICMPv6 code |[[thisRFC 8618 | | | too big | [icmp6codes] |RFC]]| |>5| | | | | 6-18446744073709551615 | Unassigned | | |+------------+----------------------+-------------------+-----------++------------------------+---------------+--------------+-----------+ Expert reviewers should take the followingpointspoint into consideration:o"ae-code" contents must be defined for atype, ortype or, if notappropriateappropriate, specified as "None". A specification of "None" requires lessstorage,storage and is therefore preferred.14.13. SecurityconsiderationsConsiderations Any control interface MUST perform authentication and encryption. Any data upload MUST be authenticated and encrypted.15.14. PrivacyconsiderationsConsiderations Storage of DNS traffic by operators in PCAP and other formats is along standinglong-standing and widespread practice. Section 2.5 of[I-D.bortzmeyer-dprive-rfc7626-bis] is[DNS-Priv-Cons] provides an analysis of the risks to Internet usersofregarding the storage of DNS traffic data in servers (recursive resolvers, authoritative servers, and rogue servers). Section 5.2 of[I-D.dickinson-dprive-bcp-op][DNS-Priv-Svc] describes mitigations for those risks for data stored on recursive resolvers (butwhichthat could by extension apply to authoritative servers). These includedata handlingdata-handling practices and methods for data minimization, IP addresspseudonymizationpseudonymization, and anonymization. AppendixBC ofthat document[DNS-Priv-Svc] presents an analysis of7seven published anonymization processes. In addition,RSSACthe ICANN Root Server System Advisory Committee (RSSAC) have recently publishedRSSAC04: [5] " Recommendations[RSSAC04] ("Recommendations on Anonymization Processes for Source IP Addresses Submitted for FutureAnalysis".Analysis"). The above analyses consider full data capture(e.g(e.g., using PCAP) as a baseline for privacyconsiderations and thereforeconsiderations; therefore, this format specification introduces no new user privacy issues beyond those of full data capture (which are quite severe). It doesprovidesprovide mechanisms to selectively record only certain fields at the time of datacapturecapture, to improve user privacy and to explicitly indicate that data issampled andsampled, anonymized, oranonymized.both. It alsoprovideprovides flags to indicate if data normalization has been performed; data normalization increases user privacy by reducing the potential for fingerprintingindividuals, however,individuals. However, a trade-off ispotentially reducingthe potential reduction of the capacity to identify attack traffic viaqueryQuery name signatures. Operators should carefully consider their operational requirements and privacy policies and SHOULD capture at the source the minimum user data required to meet their needs.18.15. References18.1.15.1. Normative References[I-D.ietf-cbor-cddl] Birkholz, H., Vigano, C., and C. Bormann, "Concise data definition language (CDDL): a notational convention to express CBOR and JSON data structures", draft-ietf-cbor- cddl-06 (work in progress), November 2018.[pcap-filter] tcpdump.org, "Manpage of PCAP-FILTER", November 2017,<http://www.tcpdump.org/manpages/pcap-filter.7.html>.<https://www.tcpdump.org/manpages/pcap-filter.7.html>. [pcap-options] tcpdump.org, "Manpage of PCAP", July 2018,<http://www.tcpdump.org/manpages/pcap.3pcap.html>.<https://www.tcpdump.org/manpages/pcap.3pcap.html>. [posix-time] The Open Group,"Section 4.16, Base Definitions,"IEEE Standard for InformationTechnology - PortableTechnology--Portable Operating System Interface (POSIX(R)) Base Specifications, Issue 7", IEEE Standard1003.1 2017 Edition,1003.1-2017, Section 4.16, DOI10.1109/IEEESTD.2018.8277153, 2017.10.1109/IEEESTD.2018.8277153. [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, RFC 792, DOI 10.17487/RFC0792, September 1981, <https://www.rfc-editor.org/info/rfc792>. [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, <https://www.rfc-editor.org/info/rfc1035>. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>. [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>. [RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification", STD 89, RFC 4443, DOI 10.17487/RFC4443, March 2006, <https://www.rfc-editor.org/info/rfc4443>. [RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, DOI 10.17487/RFC6891, April 2013, <https://www.rfc-editor.org/info/rfc6891>. [RFC7049] Bormann, C. and P. Hoffman, "Concise Binary Object Representation (CBOR)", RFC 7049, DOI 10.17487/RFC7049, October 2013, <https://www.rfc-editor.org/info/rfc7049>. [RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, <https://www.rfc-editor.org/info/rfc7858>. [RFC8094] Reddy, T., Wing, D., and P. Patil, "DNS over Datagram Transport Layer Security (DTLS)", RFC 8094, DOI 10.17487/RFC8094, February 2017, <https://www.rfc-editor.org/info/rfc8094>. [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, <https://www.rfc-editor.org/info/rfc8126>. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>. [RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, <https://www.rfc-editor.org/info/rfc8484>.18.2.[RFC8610] Birkholz, H., Vigano, C., and C. Bormann, "Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures", RFC 8610, DOI 10.17487/RFC8610, June 2019, <https://www.rfc-editor.org/info/rfc8610>. 15.2. Informative References [Avro] The Apache Software Foundation, "Apache Avro(TM)", 2019, <https://avro.apache.org/>. [ditl] DNS-OARC, "DITL",2016,2018, <https://www.dns-oarc.net/oarc/data/ditl>.[dnscap] DNS-OARC, "DNSCAP", 2016, <https://www.dns-oarc.net/tools/dnscap>. [dnstap] dnstap.info, "dnstap", 2016, <http://dnstap.info/>. [dsc] Wessels, D. and J. Lundstrom, "DSC", 2016, <https://www.dns-oarc.net/tools/dsc>. [I-D.bortzmeyer-dprive-rfc7626-bis][DNS-Priv-Cons] Bortzmeyer, S. and S. Dickinson, "DNS Privacy Considerations",draft-bortzmeyer-dprive-rfc7626-bis-01 (workWork in Progress, draft-ietf-dprive-rfc7626-bis-00, July 2019. [DNS-Priv-Svc] Dickinson, S., Overeinder, B., van Rijswijk-Deij, R., and A. Mankin, "Recommendations for DNS Privacy Service Operators", Work inprogress),Progress, draft-ietf-dprive-bcp-op-03, July2018. [I-D.daley-dnsxml]2019. [dnscap] DNS-OARC, "DNSCAP", 2018, <https://www.dns-oarc.net/tools/dnscap>. [dnstap] "dnstap", 2016, <https://dnstap.info/>. [dnstap-schema] "dnstap schema", commit d860ec1, November 2016, <https://github.com/dnstap/dnstap.pb/blob/master/ dnstap.proto>. [dnsxml] Daley, J., Ed., Morris, S., and J. Dickinson, "dnsxml - A standard XML representation of DNS data",draft-daley- dnsxml-00 (workWork inprogress),Progress, draft-daley-dnsxml-00, July 2013.[I-D.dickinson-dprive-bcp-op] Dickinson, S., Overeinder, B., Rijswijk-Deij, R.,[dsc] Wessels, D. andA. Mankin, "Recommendations for DNS Privacy Service Operators", draft-dickinson-dprive-bcp-op-01 (work in progress), July 2018.J. Lundstrom, "DSC", 2016, <https://www.dns-oarc.net/tools/dsc>. [gzip] "gzip", <https://www.gzip.org/>. [icmp6codes] IANA, "ICMPv6 "Code" Fields",2018, <https://www.iana.org/assignments/icmpv6-parameters/ icmpv6-parameters.xhtml#icmpv6-parameters-3>.<https://www.iana.org/assignments/icmpv6-parameters/>. [icmpcodes] IANA, "Code Fields",2018, <https://www.iana.org/assignments/icmp-parameters/ icmp-parameters.xhtml#icmp-parameters-codes>.<https://www.iana.org/assignments/icmp-parameters/>. [IEEE802.1Q] IEEE, "IEEE Standard for Local andmetropolitan area networks -- BridgesMetropolitan Area Networks--Bridges and Bridged Networks",DOI 10.1109/IEEESTD.2014.6991462, 2014.IEEE Standard 802.1Q. [Knot] "Knot DNS", <https://www.knot-dns.cz/>. [lz4] "LZ4", <https://lz4.github.io/lz4/>. [mmark] Gieben, M., "mmark", commit de69698, May 2019, <https://github.com/mmarkdown/mmark>. [NSD] NLnet Labs, "NSD", 2019, <https://www.nlnetlabs.nl/projects/nsd/about/>. [opcodes] IANA, "DNS OpCodes",2018, <http://www.iana.org/assignments/dns-parameters/ dns-parameters.xhtml#dns-parameters-5>.<https://www.iana.org/assignments/dns-parameters/>. [packetq] .SE - The Internet Infrastructure Foundation, "PacketQ",2014, <https://github.com/dotse/PacketQ>.commit c9b2e89, February 2019, <https://github.com/DNS-OARC/PacketQ>. [pcap]tcpdump.org,"PCAP",2016, <http://www.tcpdump.org/>.2019, <https://www.tcpdump.org/>. [pcapng]Tuexen, M., Risso, F., Bongertz, J., Combs, G., and G. Harris, "pcap-ng", 2016,"pcapng: PCAP next generation file format specification", commit 3c35b6a, March 2019, <https://github.com/pcapng/pcapng>. [Protocol-Buffers] Google LLC, "Protocol Buffers", <https://developers.google.com/protocol-buffers/>. [rcodes] IANA, "DNS RCODEs",2018, <http://www.iana.org/assignments/dns-parameters/ dns-parameters.xhtml#dns-parameters-6>. [RFC7942] Sheffer, Y.<https://www.iana.org/assignments/dns-parameters/>. [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, "Transport Layer Security (TLS) Session Resumption without Server-Side State", RFC 5077, DOI 10.17487/RFC5077, January 2008, <https://www.rfc-editor.org/info/rfc5077>. [RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A.Farrel, "Improving Awareness of Running Code: The Implementation Status Section", BCP 205,Jain, "TCP Fast Open", RFC7942,7413, DOI10.17487/RFC7942, July 2016, <https://www.rfc-editor.org/info/rfc7942>.10.17487/RFC7413, December 2014, <https://www.rfc-editor.org/info/rfc7413>. [RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", STD 90, RFC 8259, DOI 10.17487/RFC8259, December 2017, <https://www.rfc-editor.org/info/rfc8259>. [RFC8427] Hoffman, P., "Representing DNS Messages in JSON", RFC 8427, DOI 10.17487/RFC8427, July 2018, <https://www.rfc-editor.org/info/rfc8427>. [rrclasses] IANA, "DNS CLASSes",2018, <http://www.iana.org/assignments/dns-parameters/ dns-parameters.xhtml#dns-parameters-2>.<https://www.iana.org/assignments/dns-parameters/>. [rrtypes] IANA, "Resource Record (RR) TYPEs", <https://www.iana.org/assignments/dns-parameters/>. [RSSAC04] ICANN, "Recommendations on Anonymization Processes for Source IP Addresses Submitted for Future Analysis", August 2018,<http://www.iana.org/assignments/dns-parameters/ dns-parameters.xhtml#dns-parameters-4>. 18.3. URIs [1] https://github.com/dns-stats/compactor/wiki [2] https://mm.dns-stats.org/mailman/listinfo/dns-stats-users [3] https://www.sinodun.com/2017/06/compressing-pcap-files/ [4] https://www.sinodun.com/2017/06/more-on-debian-jessieubuntu- trusty-packet-capture-woes/ [5] https://www.icann.org/en/system/files/files/rssac- 040-07aug18-en.pdf [6] https://github.com/miekg/mmark [7] https://www.nlnetlabs.nl/projects/nsd/ [8] https://www.knot-dns.cz/ [9] https://avro.apache.org/ [10] https://developers.google.com/protocol-buffers/ [11] http://cbor.io [12] https://github.com/kubo/snzip [13] http://google.github.io/snappy/ [14] http://lz4.github.io/lz4/ [15] http://www.gzip.org/ [16] http://facebook.github.io/zstd/ [17] http://tukaani.org/xz/<https://www.icann.org/en/system/files/files/ rssac-040-07aug18-en.pdf>. [snappy] "snappy", <https://google.github.io/snappy/>. [snzip] "Snzip, a compression/decompression tool based on snappy", commit 809c6f2, October 2018, <https://github.com/kubo/snzip>. [xz] "XZ Utils", <https://tukaani.org/xz/>. [zstd] "Zstandard - Real-time data compression algorithm", <https://facebook.github.io/zstd/>. Appendix A. CDDL This appendix gives a CDDL[I-D.ietf-cbor-cddl][RFC8610] specification for C-DNS. CDDL does not permit a range of allowed values to be specified for a bitfield. Where necessary, those values are given as a CDDL group, but the group definition is commented out to prevent CDDL tooling from warning that the group is unused. ; CDDL specification of the file format for C-DNS, ; which describes a collection of DNS messages and ; trafficmeta-data.metadata. ; ; The overall structure of a file. ; File = [ file-type-id : "C-DNS", file-preamble : FilePreamble, file-blocks : [* Block], ] ; ; Thefile preamble.File Preamble. ; FilePreamble = { major-format-version => 1, minor-format-version => 0, ? private-version => uint, block-parameters => [+ BlockParameters], } major-format-version = 0 minor-format-version = 1 private-version = 2 block-parameters = 3 BlockParameters = { storage-parameters => StorageParameters, ? collection-parameters => CollectionParameters, } storage-parameters = 0 collection-parameters = 1 IPv6PrefixLength = 1..128 IPv4PrefixLength = 1..32 OpcodeRange = 0..15 RRTypeRange = 0..65535 StorageParameters = { ticks-per-second => uint, max-block-items => uint, storage-hints => StorageHints, opcodes => [+ OpcodeRange], rr-types => [+ RRTypeRange], ? storage-flags => StorageFlags, ? client-address-prefix-ipv4 => IPv4PrefixLength, ? client-address-prefix-ipv6 => IPv6PrefixLength, ? server-address-prefix-ipv4 => IPv4PrefixLength, ? server-address-prefix-ipv6 => IPv6PrefixLength, ? sampling-method => tstr, ?anonymisation-methodanonymization-method => tstr, } ticks-per-second = 0 max-block-items = 1 storage-hints = 2 opcodes = 3 rr-types = 4 storage-flags = 5 client-address-prefix-ipv4 = 6 client-address-prefix-ipv6 = 7 server-address-prefix-ipv4 = 8 server-address-prefix-ipv6 = 9 sampling-method = 10anonymisation-methodanonymization-method = 11 ; A hint indicatesifwhether the collection method willoutput thealways omit ;item or will ignorethe itemif present.from the file. StorageHints = { query-response-hints => QueryResponseHints, query-response-signature-hints => QueryResponseSignatureHints, rr-hints => RRHints, other-data-hints => OtherDataHints, } query-response-hints = 0 query-response-signature-hints = 1 rr-hints = 2 other-data-hints = 3 QueryResponseHintValues = &( time-offset : 0, client-address-index : 1, client-port : 2, transaction-id : 3, qr-signature-index : 4, client-hoplimit : 5, response-delay : 6, query-name-index : 7, query-size : 8, response-size : 9, response-processing-data : 10, query-question-sections : 11, ; Second & subsequent ;questionsQuestions query-answer-sections : 12, query-authority-sections : 13, query-additional-sections : 14, response-answer-sections : 15, response-authority-sections : 16, response-additional-sections : 17, ) QueryResponseHints = uint .bits QueryResponseHintValues QueryResponseSignatureHintValues = &(server-addressserver-address-index : 0, server-port : 1, qr-transport-flags : 2, qr-type : 3, qr-sig-flags : 4, query-opcode : 5,dns-flagsqr-dns-flags : 6, query-rcode : 7,query-class-typequery-classtype-index : 8, query-qdcount : 9, query-ancount : 10,query-arcountquery-nscount : 11,query-nscountquery-arcount : 12, query-edns-version : 13, query-udp-size : 14,query-opt-rdataquery-opt-rdata-index : 15, response-rcode : 16, ) QueryResponseSignatureHints = uint .bits QueryResponseSignatureHintValues RRHintValues = &( ttl : 0, rdata-index : 1, ) RRHints = uint .bits RRHintValues OtherDataHintValues = &( malformed-messages : 0, address-event-counts : 1, ) OtherDataHints = uint .bits OtherDataHintValues StorageFlagValues = &(anonymised-dataanonymized-data : 0, sampled-data : 1, normalized-names : 2, ) StorageFlags = uint .bits StorageFlagValues ;Hints for later analysis.Metadata about data collection VLANIdRange = 1..4094 CollectionParameters = { ? query-timeout => uint, ; Milliseconds ? skew-timeout => uint, ; Microseconds ? snaplen => uint, ? promisc => bool, ? interfaces => [+ tstr], ? server-addresses => [+ IPAddress], ? vlan-ids => [+ VLANIdRange], ? filter => tstr, ? generator-id => tstr, ? host-id => tstr, } query-timeout = 0 skew-timeout = 1 snaplen = 2 promisc = 3 interfaces = 4 server-addresses = 5 vlan-ids = 6 filter = 7 generator-id = 8 host-id = 9 ; ; Data in the file is stored in Blocks. ; Block = { block-preamble => BlockPreamble, ? block-statistics => BlockStatistics, ; Much of this ; could be derived ? block-tables => BlockTables, ? query-responses => [+ QueryResponse], ? address-event-counts => [+ AddressEventCount], ? malformed-messages => [+ MalformedMessage], } block-preamble = 0 block-statistics = 1 block-tables = 2 query-responses = 3 address-event-counts = 4 malformed-messages = 5 ; ; The (mandatory) preamble to ablock.Block. ; BlockPreamble = { ? earliest-time => Timestamp, ? block-parameters-index => uint .default 0, } earliest-time = 0 block-parameters-index = 1 ; Ticks aresubsecondsub-second intervals. The number of ticks in a second is ; file/block metadata. Signed and unsigned tick types are defined. ticks = int uticks = uint Timestamp = [ timestamp-secs : uint,timestamp-uticks; POSIX time timestamp-ticks : uticks, ] ; ; Statistics about theblockBlock contents. ; BlockStatistics = { ? processed-messages => uint, ? qr-data-items => uint, ? unmatched-queries => uint, ? unmatched-responses => uint, ? discarded-opcode => uint, ? malformed-items => uint, } processed-messages = 0 qr-data-items = 1 unmatched-queries = 2 unmatched-responses = 3 discarded-opcode = 4 malformed-items = 5 ; ; Tables of common data referenced from records in ablock.Block. ; BlockTables = { ? ip-address => [+ IPAddress], ? classtype => [+ ClassType], ? name-rdata => [+ bstr], ; Holds bothNamesnames ; and RDATA ? qr-sig => [+ QueryResponseSignature], ? QuestionTables, ? RRTables, ? malformed-message-data => [+ MalformedMessageData], } ip-address = 0 classtype = 1 name-rdata = 2 qr-sig = 3 qlist = 4 qrr = 5 rrlist = 6 rr = 7 malformed-message-data = 8 IPv4Address = bstr .size4(0..4) IPv6Address = bstr .size16(0..16) IPAddress = IPv4Address / IPv6Address ClassType = { type => uint, class => uint, } type = 0 class = 1 QueryResponseSignature = { ? server-address-index => uint, ? server-port => uint, ? qr-transport-flags => QueryResponseTransportFlags, ? qr-type => QueryResponseType, ? qr-sig-flags => QueryResponseFlags, ? query-opcode => uint, ? qr-dns-flags => DNSFlags, ? query-rcode => uint, ? query-classtype-index => uint, ?query-qd-countquery-qdcount => uint, ?query-an-countquery-ancount => uint, ?query-ns-countquery-nscount => uint, ?query-ar-countquery-arcount => uint, ?edns-versionquery-edns-version => uint, ?udp-buf-sizequery-udp-size => uint, ?opt-rdata-indexquery-opt-rdata-index => uint, ? response-rcode => uint, } server-address-index = 0 server-port = 1 qr-transport-flags = 2 qr-type = 3 qr-sig-flags = 4 query-opcode = 5 qr-dns-flags = 6 query-rcode = 7 query-classtype-index = 8query-qd-countquery-qdcount = 9query-an-countquery-ancount = 10query-ns-countquery-nscount =12 query-ar-count11 query-arcount = 12edns-versionquery-edns-version = 13udp-buf-sizequery-udp-size = 14opt-rdata-indexquery-opt-rdata-index = 15 response-rcode = 16 ; Transport gives the values that may appear in bits 1..4 of ; TransportFlags. There is currently no way to express this in ; CDDL, so Transport is unused. To avoid confusion when used ; with CDDL tools, it is commented out. ; ; Transport = &( ; udp : 0, ; tcp : 1, ; tls : 2, ; dtls : 3, ;dohhttps : 4, ; non-standard : 15, ; ) TransportFlagValues = &( ip-version : 0, ; 0=IPv4, 1=IPv6 ) / (1..4) TransportFlags = uint .bits TransportFlagValues QueryResponseTransportFlagValues = &( query-trailingdata : 5, ) / TransportFlagValues QueryResponseTransportFlags = uint .bits QueryResponseTransportFlagValues QueryResponseType = &( stub : 0, client : 1, resolver : 2, auth : 3, forwarder : 4, tool : 5, ) QueryResponseFlagValues = &( has-query : 0,has-reponsehas-response : 1, query-has-opt : 2, response-has-opt : 3, query-has-no-question : 4, response-has-no-question: 5, ) QueryResponseFlags = uint .bits QueryResponseFlagValues DNSFlagValues = &( query-cd : 0, query-ad : 1, query-z : 2, query-ra : 3, query-rd : 4, query-tc : 5, query-aa : 6, query-do : 7, response-cd: 8, response-ad: 9, response-z : 10, response-ra: 11, response-rd: 12, response-tc: 13, response-aa: 14, ) DNSFlags = uint .bits DNSFlagValues QuestionTables = ( qlist => [+ QuestionList], qrr => [+ Question] ) QuestionList = [+ uint] ; Index of Question Question = { ; Second and subsequentquestionsQuestions name-index => uint, ; Index to a name in the ; name-rdata table classtype-index => uint, } name-index = 0 classtype-index = 1 RRTables = ( rrlist => [+ RRList], rr => [+ RR] ) RRList = [+ uint] ; Index of RR RR = { name-index => uint, ; Index to a name in the ; name-rdata table classtype-index => uint, ? ttl => uint, ? rdata-index => uint, ; Index to RDATA in the ; name-rdata table } ; Other map key values already defined above. ttl = 2 rdata-index = 3 MalformedMessageData = { ? server-address-index => uint, ? server-port => uint, ? mm-transport-flags => TransportFlags, ? mm-payload => bstr, } ; Other map key values already defined above. mm-transport-flags = 2 mm-payload = 3 ; ; A singlequery/response pair.Query/Response data item. ; QueryResponse = { ? time-offset => uticks, ; Time offset from ; start ofblockBlock ? client-address-index => uint, ? client-port => uint, ? transaction-id => uint, ? qr-signature-index => uint, ? client-hoplimit => uint, ? response-delay => ticks, ? query-name-index => uint, ? query-size => uint, ; DNS size ofqueryQuery ? response-size => uint, ; DNS size ofresponseResponse ? response-processing-data => ResponseProcessingData, ? query-extended => QueryResponseExtended, ? response-extended => QueryResponseExtended, } time-offset = 0 client-address-index = 1 client-port = 2 transaction-id = 3 qr-signature-index = 4 client-hoplimit = 5 response-delay = 6 query-name-index = 7 query-size = 8 response-size = 9 response-processing-data = 10 query-extended = 11 response-extended = 12 ResponseProcessingData = { ? bailiwick-index => uint, ? processing-flags => ResponseProcessingFlags, } bailiwick-index = 0 processing-flags = 1 ResponseProcessingFlagValues = &( from-cache : 0, ) ResponseProcessingFlags = uint .bits ResponseProcessingFlagValues QueryResponseExtended = { ? question-index => uint, ; Index of QuestionList ? answer-index => uint, ; Index of RRList ? authority-index => uint, ? additional-index => uint, } question-index = 0 answer-index = 1 authority-index = 2 additional-index = 3 ; ; Address event data. ; AddressEventCount = { ae-type => &AddressEventType, ? ae-code => uint, ae-address-index => uint, ? ae-transport-flags => TransportFlags, ae-count => uint, } ae-type = 0 ae-code = 1 ae-address-index = 2ae-countae-transport-flags = 3 ae-count = 4 AddressEventType = ( tcp-reset : 0, icmp-time-exceeded : 1, icmp-dest-unreachable : 2, icmpv6-time-exceeded : 3, icmpv6-dest-unreachable: 4, icmpv6-packet-too-big : 5, ) ; ; Malformed messages. ; MalformedMessage = { ? time-offset => uticks, ; Time offset from ; start ofblockBlock ? client-address-index => uint, ? client-port => uint, ? message-data-index => uint, } ; Other map key values already defined above. message-data-index = 3 Appendix B. DNS Namecompression exampleCompression Example The basic algorithm, which follows the guidance in [RFC1035], is simply to collect each name, and the offset in the packet at which it starts, during packet construction. As each name is added, it is offered to each of the collected names in order of collection, starting from the first name. If (1) labels at the end of the name can be replaced with a reference back to part (or all) of the earliername,name andif(2) the uncompressed part of the name is shorter than any compression already found, the earlier name is noted as the compression target for the name. The following tables illustrate theprocess.step-by-step process of adding names and performing name compression. In an example packet, the first name added isfoo.example.foo.example, which cannot be compressed. +---+-------------+--------------+--------------------+ | N | Name | Uncompressed | Compression Target | +---+-------------+--------------+--------------------+ | 1 | foo.example | foo.example | None | +---+-------------+--------------+--------------------+ The next name added is bar.example. This is matched against foo.example. The example part of this can be used as a compression target, with the remaining uncompressed part of the name being bar. +---+-------------+--------------+-----------------------+ | N | Name | Uncompressed | Compression Target | +---+-------------+--------------+-----------------------+ | 1 | foo.example | foo.example | None | | 2 | bar.example | bar | 1 + offset to example | +---+-------------+--------------+-----------------------+ The third name added is www.bar.example. This is first matched against foo.example, and as before this is recorded as a compression target, with the remaining uncompressed part of the name being www.bar. It is then matched against the second name, which again can be a compression target. Because the remaining uncompressed part of the name is www, this is an improved compression, and so it is adopted. +---+-----------------+--------------+-----------------------+ | N | Name | Uncompressed | Compression Target | +---+-----------------+--------------+-----------------------+ | 1 | foo.example | foo.example | None | | 2 | bar.example | bar | 1 + offset to example | | 3 | www.bar.example | www | 2 | +---+-----------------+--------------+-----------------------+ As an optimization, if a name is already perfectly compressed (in other words, the uncompressed part of the name is empty), then no further names will be considered for compression. B.1. NSDcompression algorithmCompression Algorithm Using the above basicalgorithmalgorithm, the packet lengths ofresponsesResponses generated byNSD [7]the Name Server Daemon (NSD) [NSD] can be matched almost exactly. At the time of writing, a tiny number (<.01%) of the reconstructed packets had incorrect lengths. B.2. Knot Authoritativecompression algorithmCompression Algorithm The Knot Authoritative[8]name server [Knot] uses different compression behavior, which is the result of internal optimization designed to balance runtime speed with compression size gains. In brief, and omitting complications, Knot Authoritative will only consider the QNAME and names in the immediately preceding RR section in an RRSET as compression targets. A set of smart heuristics as described below can be implemented to mimicthisthis, and while notperfectperfect, it produces output nearly, but not quite, as good a match as with NSD. The heuristicsare:are as follows: 1. A match is only perfect if the name is completely compressed AND the TYPE of the section in which the name occurs matches the TYPE of the name used as the compression target. 2. If the name occurs in RDATA: * If the compression target name is in aquery,Query, then only the first RR in an RRSET can use that name as a compression target. * The compression target name MUST be in RDATA. * The name section TYPE must match the compression target name section TYPE. * The compression target name MUST be in the immediately preceding RR in the RRSET. Using thisalgorithmalgorithm, less than 0.1% of the reconstructed packets had incorrect lengths. B.3. ObserveddifferencesDifferences In sample traffic collected on a root nameserverserver, around 2-4% ofresponsesResponses generated by Knot had different packet lengthstothan those produced by NSD. Appendix C. Comparison of Binary Formats Several binaryserialisationserialization formats wereconsidered, and for completenessconsidered. For completeness, they were also compared to JSON. o Apache Avro[9].[Avro]. Data is stored according to apre-definedpredefined schema. The schema itself is always included in the data file. Data can therefore be stored untagged, for a smallerserialisationserialization size, and be written and read by an Avro library. * At the time of writing, Avro libraries are available for C, C++, C#, Java, Python,RubyRuby, and PHP.OptionallyOptionally, tools are available for C++,JavaJava, and C# to generate code for encoding and decoding. o Google Protocol Buffers[10].[Protocol-Buffers]. Data is stored according to apre- definedpredefined schema. The schema is used by a generator to generate code for encoding and decoding the data. Data can therefore be stored untagged, for a smallerserialisationserialization size. The schema is not stored with the data, so unlikeAvroAvro, it cannot be read with a generic library. * Code must be generated for a particular data schema to read and write data using that schema. At the time of writing, the Google code generator can currently generate code for encoding and decoding a schema for C++, Go, Java, Python, Ruby, C#, Objective-C,JavascriptJavaScript, and PHP. o CBOR[11]. Defined in [RFC7049], this serialisation[RFC7049]. This serialization format is comparable to JSON but with a binary representation. It does not use apre-definedpredefined schema, so data is always stored tagged. However, CBOR data schemas can be described using CDDL[I-D.ietf-cbor-cddl][RFC8610], and tools exist to verify that data files conform to the schema. * CBOR is a simpleformat,format and is simple to implement. At the time of writing, the CBOR website lists implementations for 16 languages. Avro and Protocol Buffers both allow storage of untagged data, but because they rely on the data schema for this, their implementation is considerably more complex than CBOR. Using Avro or Protocol Buffers in an unsupported environment would require notably greater development effort compared to CBOR. A test program was writtenwhichthat reads input from a PCAP file and writes output using one of two basicstructures;structures: either a simple structure, where eachquery/responseQuery/Response pair is represented in a single record entry, or the C-DNS block structure. The resulting output files were then compressed using a variety of common general-purpose lossless compression tools to explore the compressibility of the formats. The compression tools employed were: o snzip[12].[snzip]. Acommand linecommand-line compression tool based on the Google Snappy[13] library.library [snappy]. o lz4[14].[lz4]. Thecommand linecommand-line compression tool from the reference C LZ4 implementation. o gzip[15].[gzip]. The ubiquitous GNU zip tool. o zstd[16].[zstd]. Compression using the Zstandard algorithm. o xz[17].[xz]. A popular compression tool noted for high compression. In allcasescases, the compression tools were run using their default settings. Note that thisdraftdocument does not mandate the use of compression, nor any particular compression scheme, but it anticipates that in practice output data will be subject to general-purpose compression, and so this should be taken into consideration. "test.pcap", a662Mb662 MB capture of sample data from a rootinstanceinstance, was used for the comparison. The following table shows the formatted size and size after compression (abbreviated to Comp. in the table headers), together with the taskresident set sizeResident Set Size (RSS) and the user time taken by the compression. File sizes are inMb,MB, RSS is inkbkB, and user time is in seconds. +-------------+-----------+-------+------------+-------+-----------+ | Format | FilesizeSize | Comp. | Comp.sizeSize | RSS | UsertimeTime | +-------------+-----------+-------+------------+-------+-----------+ | PCAP | 661.87 | snzip | 212.48 | 2696 | 1.26 | | | | lz4 | 181.58 | 6336 | 1.35 | | | | gzip | 153.46 | 1428 | 18.20 | | | | zstd | 87.07 | 3544 | 4.27 | | | | xz | 49.09 | 97416 | 160.79 | | | | | | | | | JSON simple | 4113.92 | snzip | 603.78 | 2656 | 5.72 | | | | lz4 | 386.42 | 5636 | 5.25 | | | | gzip | 271.11 | 1492 | 73.00 | | | | zstd | 133.43 | 3284 | 8.68 | | | | xz | 51.98 | 97412 | 600.74 | | | | | | | | | Avro simple | 640.45 | snzip | 148.98 | 2656 | 0.90 | | | | lz4 | 111.92 | 5828 | 0.99 | | | | gzip | 103.07 | 1540 | 11.52 | | | | zstd | 49.08 | 3524 | 2.50 | | | | xz | 22.87 | 97308 | 90.34 | | | | | | | | | CBOR simple | 764.82 | snzip | 164.57 | 2664 | 1.11 | | | | lz4 | 120.98 | 5892 | 1.13 | | | | gzip | 110.61 | 1428 | 12.88 | | | | zstd | 54.14 | 3224 | 2.77 | | | | xz | 23.43 | 97276 | 111.48 | | | | | | | | | PBuf simple | 749.51 | snzip | 167.16 | 2660 | 1.08 | | | | lz4 | 123.09 | 5824 | 1.14 | | | | gzip | 112.05 | 1424 | 12.75 | | | | zstd | 53.39 | 3388 | 2.76 | | | | xz | 23.99 | 97348 | 106.47 | | | | | | | | | JSON block | 519.77 | snzip | 106.12 | 2812 | 0.93 | | | | lz4 | 104.34 | 6080 | 0.97 | | | | gzip | 57.97 | 1604 | 12.70 | | | | zstd | 61.51 | 3396 | 3.45 | | | | xz | 27.67 | 97524 | 169.10 | | | | | | | | | Avro block | 60.45 | snzip | 48.38 | 2688 | 0.20 | | | | lz4 | 48.78 | 8540 | 0.22 | | | | gzip | 39.62 | 1576 | 2.92 | | | | zstd | 29.63 | 3612 | 1.25 | | | | xz | 18.28 | 97564 | 25.81 | | | | | | | | | CBOR block | 75.25 | snzip | 53.27 | 2684 | 0.24 | | | | lz4 | 51.88 | 8008 | 0.28 | | | | gzip | 41.17 | 1548 | 4.36 | | | | zstd | 30.61 | 3476 | 1.48 | | | | xz | 18.15 | 97556 | 38.78 | | | | | | | | | PBuf block | 67.98 | snzip | 51.10 | 2636 | 0.24 | | | | lz4 | 52.39 | 8304 | 0.24 | | | | gzip | 40.19 | 1520 | 3.63 | | | | zstd | 31.61 | 3576 | 1.40 | | | | xz | 17.94 | 97440 | 33.99 | +-------------+-----------+-------+------------+-------+-----------+ The above results are discussed in the following sections. C.1. Comparison withfullFull PCAPfilesFiles An important first consideration is whether moving away from PCAP offers significant benefits. The simple binary formats are typically larger than PCAP, even though they omit some information such as EthernetMACMedia Access Control (MAC) addresses. But not only do they require less CPU to compress than PCAP, the resulting compressed files are smaller than compressed PCAP. C.2. Simple versusblock codingBlock Coding The intention of the block coding is to perform datade-duplicationdeduplication onquery/responseQuery/Response records within the block. The simple and block formats shown above store exactly the same information for eachquery/ responseQuery/Response record. This information is parsed from the DNS traffic in the input PCAP file, and in all cases each field has an identifier and the field data is typed. The datade-duplicationdeduplication on the block formats show anorder oforder-of- magnitude reduction in the size of the format file size against the simple formats. As would be expected, the compression tools are able to find and exploit a lot of this duplication, but as thede- duplicationdeduplication process uses knowledge of DNS traffic, it is able to retain a size advantage. This advantage reduces as stronger compression is applied, as again would be expected, but even with the strongest compression applied theblock formattedblock-formatted data remains around 75% of the size of the simple format and its compression requires roughly a third of the CPU time. C.3. Binary versustext formatsText Formats Text data formats offer many advantages over binary formats, particularly in the areas ofad-hocad hoc data inspection and extraction. It was therefore felt worthwhile to carry out a direct comparison, implementing JSON versions of the simple and block formats. Concentrating on JSON block format, the format files produced are a significant fraction of an order of magnitude larger than binary formats. The impact on file size after compression is as might be expected from that starting point; the stronger compression produces files that are 150% of the size of similarly compressed binaryformat,format and require over 4x more CPU to compress. C.4. Performance Concentrating again on the block formats, all three produce format files that are close to an order of magnitude smallerthatthan the original "test.pcap" file. CBOR produces the largest files and Avro the smallest, 20% smaller than CBOR. However, once compression is taken into account, the size difference narrows. At medium compression (with gzip), the size difference is 4%. Using strong compression (withxz)xz), the difference reduces to 2%, with Avro the largest and Protocol Buffers the smallest, although CBOR and Protocol Buffers require slightly more compression CPU. The measurements presented above do not include data on the CPU required to generate the format files. Measurements indicate that writing Avro requires 10% more CPU than CBOR or Protocol Buffers. It appears, therefore, that Avro's advantage in compression CPU usage is probably offset by a larger CPU requirement in writing Avro. C.5. Conclusions The above assessments lead us to the choice of a binary format file using blocking. As noted previously, thisdraftdocument anticipates that output data will be subject to compression. There is no compelling case for one particular binaryserialisationserialization format in terms of either final file size or machine resources consumed, so the choice must be largely based on other factors. CBOR was therefore chosen as the binaryserialisationserialization format for the reasons listed in Section 5. C.6. Blocksize choiceSize Choice Given the choice of a CBOR format using blocking, the question arises of what an appropriate default value for the maximum number ofquery/ responseQuery/Response pairs in a block should be. This has twocomponents; whatcomponents: 1. What is the impact on performance of using different block sizes in the formatfile, and whatfile? 2. What is the impact on the size of the format file before and aftercompression.compression? The following table addresses the performance question, showing the impact on the performance of a C++ program converting "test.pcap" to C-DNS. Filesizesizes are in MB, RSS is inMb, resident set size (RSS)kB, and user time is inkb.seconds. +------------+-----------+--------+-----------+ | BlocksizeSize | FilesizeSize | RSS | UsertimeTime | +------------+-----------+--------+-----------+ |10001,000 | 133.46 | 612.27 | 15.25 | |50005,000 | 89.85 | 676.82 | 14.99 | |1000010,000 | 76.87 | 752.40 | 14.53 | |2000020,000 | 67.86 | 750.75 | 14.49 | |4000040,000 | 61.88 | 736.30 | 14.29 | |8000080,000 | 58.08 | 694.16 | 14.28 | |160000160,000 | 55.94 | 733.84 | 14.44 | |320000320,000 | 54.41 | 799.20 | 13.97 | +------------+-----------+--------+-----------+IncreasingTherefore, increasing blocksize, therefore,size tends to increase maximum RSS a little, with no significant effect (ifanythinganything, a small reduction) on CPU consumption. The following table demonstrates the effect of increasing block size on output file size for different compressions. +------------+--------+-------+-------+-------+-------+-------+ | BlocksizeSize | None | snzip | lz4 | gzip | zstd | xz | +------------+--------+-------+-------+-------+-------+-------+ |10001,000 | 133.46 | 90.52 | 90.03 | 74.65 | 44.78 | 25.63 | |50005,000 | 89.85 | 59.69 | 59.43 | 46.99 | 37.33 | 22.34 | |1000010,000 | 76.87 | 50.39 | 50.28 | 38.94 | 33.62 | 21.09 | |2000020,000 | 67.86 | 43.91 | 43.90 | 33.24 | 32.62 | 20.16 | |4000040,000 | 61.88 | 39.63 | 39.69 | 29.44 | 28.72 | 19.52 | |8000080,000 | 58.08 | 36.93 | 37.01 | 27.05 | 26.25 | 19.00 | |160000160,000 | 55.94 | 35.10 | 35.06 | 25.44 | 24.56 | 19.63 | |320000320,000 | 54.41 | 33.87 | 33.74 | 24.36 | 23.44 | 18.66 | +------------+--------+-------+-------+-------+-------+-------+ There is obviously scope for tuning the default block size to the compression being employed, traffic characteristics, frequency of output filerolloverrollover, etc. Using a strong compression scheme, block sizes over 10,000query/responseQuery/Response pairs would seem to offer limited improvements.16.Appendix D. Data Fields for Traffic Regeneration D.1. Recommended Fields for Traffic Regeneration This section specifies the data fields that would need to be captured in order to perform the fullest PCAP traffic reconstruction for well-formed DNS messages that is possible with C-DNS. o All data fields in the QueryResponse type except response- processing-data. o All data fields in the QueryResponseSignature type except qr-type. o All data fields in the RR TYPE. D.2. Issues with Small Data Captures At the other extreme, an interesting corner case arises when opting to perform captures with a smaller data set than that recommended above. The following list specifies a subset of the above data fields; if only these data fields are captured, then even a minimal traffic reconstruction is problematic because there is not enough information to determine if the Query/Response data item contained just a Query, just a Response, or a Query/Response pair. o The following data fields from the QueryResponse type: * time-offset * client-address-index * client-port * transaction-id * query-name-index o The following data fields from the QueryResponseSignature type: * server-address-index * server-port * qr-transport-flags * query-classtype-index In this case, simply also capturing the qr-sig-flags will provide enough information to perform a minimal traffic reconstruction (assuming that suitable defaults for the remaining fields are provided). Additionally, capturing response-delay, query-opcode, and response-rcode will avoid having to rely on potentially misleading defaults for these values and should result in a PCAP that represents the basics of the real traffic flow. Acknowledgements The authors wish to thankCZ.NIC,CZ.NIC -- inparticularparticular, TomasGavenciak,Gavenciak -- for many useful discussions on binary formats,compressioncompression, and packet matching.AlsoThanks also to Jan Vcelak and Wouter Wijngaards for discussions on namecompressioncompression, and Paul Hoffman for a detailed review ofthethis document and the C-DNS CDDL. Thanks also to Robert Edmonds, JerryLundstroem,Lundstrom, Richard Gibson, StephaneBortzmeyerBortzmeyer, and many other members of DNSOP for review. Also, thanks to Miek Gieben formmark [6][mmark]. Authors' Addresses John Dickinson Sinodun IT Magdalen Centre Oxford Science Park Oxford OX4 4GA United Kingdom Email: jad@sinodun.com Jim Hague Sinodun IT Magdalen Centre Oxford Science Park Oxford OX4 4GA United Kingdom Email: jim@sinodun.com Sara Dickinson Sinodun IT Magdalen Centre Oxford Science Park Oxford OX4 4GA United Kingdom Email: sara@sinodun.com Terry Manderson ICANN 12025 Waterfront Drive Suite 300 LosAngelesAngeles, CA 90094-2536 United States of America Email: terry.manderson@icann.org John BondICANN 12025 Waterfront DriveWikimedia Foundation, Inc. 1 Montgomery Street Suite300 Los Angeles1600 San Francisco, CA90094-253694104 United States of America Email:john.bond@icann.orgietf-wikimedia@johnbond.org