1. clientip:clientport, used by tcpopen/tcpclose entries,
2. clientip:clientport:id, used by "query" entries.
+ We convert each part from hex to decimal, and in the second
+ format, separate the packet id from the client information.
+
Parameters
----------
entry.
A single "serverip" field is present in the lame, nodata,
- nxdomain, and rr entry types.
+ nxdomain, and rr entry types. We convert it from hex to decimal.
Parameters
----------
>>> decode_ip(words, 1)
>>> words
['foo', '0000:0000:0000:0000:0000:ffff:7f00:0001', 'bar', 'quux']
-
"""
words[i] = convert_ip(words[i])
entry.
A single "ttl" field is present in the nodata, nxdomain, and
- rr entry types.
+ rr entry types. We prefix it with "TTL=" so that its meaning
+ is clear in the human-readable logs.
Parameters
----------
words[i] = f"TTL={words[i]}"
def decode_serial(words : list, i : int):
- serial = int(words[i])
- words[i] = f"#{serial}"
+ r"""
+ Helper function to decode the serial field in a dnscache log
+ entry.
+
+ A single "serial" field is present in the drop and query entry
+ types. It's already in decimal; we simply prefix it with a hash.
+
+ Parameters
+ ----------
+
+ words : list
+ The ``words`` list (a list of fields) from
+ :func:`handle_dnscache_log`.
+
+ i : int
+ The index of the serial field within ``words``
+
+ Returns
+ -------
+
+ Nothing; the ``i``th entry in the ``words`` list is modified
+ in-place.
+
+ Examples
+ --------
+
+ >>> words = ["1", "7f000001:a3db:4fb9", "1", "www.example.com."]
+ >>> decode_serial(words, 0)
+ >>> words
+ ['#1', '7f000001:a3db:4fb9', '1', 'www.example.com.']
+
+ """
+ words[i] = f"#{words[i]}"
def decode_type(words : list, i : int):
qt = words[i]