Handling of unsolicited DNS responses.
When a DNS response is received that has a different ID there are 2 issues:
- An unsolicited DNS response event is not raised.
- The legitimate response, received after the unsolicted response is not logged.
The first issue is the unsolicted response caused a new transaction to be created without incrementing the transaction ID first, which meant we had 2 transactions with the same ID causing the event to not be recorded correctly.
The second issue is due to transactions which are not complete not being fully logged if a more recent transaction has been fully logged - other protocols that can have overlapping transactions such as DNP3 can also run into this issue.