-
-
Advanced Policy Expressions: Working with Dates, Times, and Numbers
-
Advanced Policy Expressions: Parsing HTTP, TCP, and UDP Data
-
Expressions for Identifying the Protocol in an Incoming IP Packet
-
Expressions for HTTP Status Codes and Numeric HTTP Payload Data Other Than Dates
-
Operations for HTTP, HTML, and XML Encoding and “Safe” Characters
-
Expressions for Evaluating a DNS Message and Identifying Its Carrier Protocol
-
Advanced Policy Expressions: IP and MAC Addresses, Throughput, VLAN IDs
-
-
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Expressions for evaluating a DNS message and identifying its carrier protocol
You can evaluate DNS requests and responses by using expressions that begin with DNS.REQ and DNS.RES, respectively. You can also identify the transport layer protocol that is being used to send the DNS messages.
The following functions return the contents of a DNS query.
Function | Description |
---|---|
DNS.REQ.QUESTION.DOMAIN | Return the domain name (the value of the QNAME field) in the question section of the DNS query. The domain name is returned as a text string, which can be passed to EQ(), NE(), and any other functions that work with text. |
DNS.REQ.QUESTION.TYPE | Return the query type (the value of the QTYPE field) in the DNS query. The field indicates the type of resource record (for example, A, NS, or CNAME) for which the name server is being queried. The returned value can be compared to one of the following values by using the EQ() and NE()functions: A, AAAA, NS, SRV, PTR, CNAME, SOA, MX, and ANY. Note: You can use only the EQ() and NE() functions with the TYPE function. Example: DNS.REQ.QUESTION.TYPE.EQ(MX) |
The following functions return the contents of a DNS response.
Function | Description |
---|---|
DNS.RES.HEADER.RCODE | Return the response code (the value of the RCODE field) in the header section of the DNS response. You can use only the EQ() and NE() functions with the RCODE function. Following are the possible values: NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, and REFUSED. |
DNS.RES.QUESTION.DOMAIN | Return the domain name (the value of the QNAME field) in the question section of the DNS response. The domain name is returned as a text string, which can be passed to EQ(), NE(), and any other functions that work with text. |
DNS.RES.QUESTION.TYPE | Return the query type (the value of the QTYPE field) in the question section of the DNS response. The field indicates the type of resource record (for example, A, NS, or CNAME) that is contained in the response. The returned value can be compared to one of the following values by using the EQ()and NE() functions: A, AAAA, NS, SRV, PTR, CNAME, SOA, MX, and ANY. You can use only the EQ() and NE() functions with the TYPE function. Example: DNS.RES.QUESTION.TYPE.EQ(SOA) |
The following functions return the transport layer protocol name.
Function | Description |
---|---|
DNS.REQ.TRANSPORT | Return the name of the transport layer protocol that was used to send the DNS query. Possible values returned are TCP and UDP. You can use only the EQ() and NE() functions with the TRANSPORT function. Example: DNS.REQ.TRANSPORT.EQ(TCP) |
DNS.RES.TRANSPORT | Return the name of the transport layer protocol that was used for the DNS response. Possible values returned are TCP and UDP. You can use only the EQ() and NE() functions with the TRANSPORT function. Example: DNS.RES.TRANSPORT.EQ(TCP) |
The following functions return the name of the matched location when the query contains or does not contain the DNS ECS option.
Function | Description |
---|---|
DNS.REQ.OPT.ECS.IP.MATCHES_LOCATION | Return the name of the matched location that was used in the query with the DNS ECS option. Example:(DNS.REQ.OPT.ECS.IP.MATCHES_LOCATION(“.CH…..”) |
client.IP.SRC.MATCHES_LOCATION | Return the name of the matched location that was used in the query without the DNS ECS option. Example: (client.IP.SRC.MATCHES_LOCATION(“.CH…..”) |
DNS.REQ.OPT.ECS.IP.MATCHES_LOCATION OR client.IP.SRC.MATCHES_LOCATION | Common expression to be used in the policy when the DNS traffic may or may not have ECS option in the query. Example: “(((DNS.REQ.OPT.ECS.IP.MATCHES_LOCATION(“.CH…..”).typecast_text_t) ALT (client.IP.SRC.MATCHES_LOCATION(“.CH…..”).typecast_text_t)).eq(“true”))” |
Share
Share
In this article
This Preview product documentation is Cloud Software Group Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Cloud Software Group Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Cloud Software Group product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.