7.13.1 The dns_mapping record

All of the events handled by the module include at least one record of DNS mapping information, defined by the dns_mapping type shown in the example below. The corresponding fields are:

creation_time

When the mapping was created.

req_host

The hostname looked up, or an empty string if this was not a hostname lookup.

req_addr

The address looked up (reverse lookup), or 0.0.0.0 if this was not an address lookup.

valid

True if an answer was received for a lookup (even if the answer was that the request name or address does not exist in the DNS).

hostname

The hostname answer in response to an address lookup, or the string "<none>" if an answer was received but it indicated there was no PTR record for the given address.

addrs

A set of addresses in response to a hostname lookup. Empty if an answer was received but it indicated that there was no A record for the given hostname.

     type dns_mapping: record {
         creation_time: time;  # When the mapping was created.
     
         req_host: string;     # The hostname in the request, if any.
         req_addr: addr;       # The address in the request, if any.
     
         valid: bool;          # Whether we received an answer.
         hostname: string;     # The hostname in the answer, or "<none>".
         addrs: set[addr];     # The addresses in the answer, if any.
     };