Actions
Task #3556
openTask #3553: Tracking: enable GAP recovery for all TCP app-layer protocols
dns: improve GAP recovery
Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:
Description
DNS currently expects data after GAP at the start of the post-GAP data. To avoid high cost we can perhaps make the search for the next record a bit efficient for a common case (e.g. only a single query).
Also, it would useful if the parser can notify the stream engine of the record size of the current record, so that when a GAP happens that is smaller than the current record we can know where the next record starts.
Actions