Suricata

DNS currently expects data after GAP at the start of the post-GAP data. To avoid high cost we can perhaps make the search for the next record a bit efficient for a common case (e.g. only a single query).

Also, it would useful if the parser can notify the stream engine of the record size of the current record, so that when a GAP happens that is smaller than the current record we can know where the next record starts.