geoff at geoff.co.uk (Geoffrey Sisson) wrote: > So: > > (udp[10:2] & 0x8000 = 0) # QR = 1 And that should be: (udp[10:2] & 0x8000 = 0) # QR = 0 (Expression was correct, comment was wrong.) > udp[12:2] = 1 # QDCOUNT = 1 > > udp[20] = 0 # QNAME = '.' > > udp[21:2] = 2 # QTYPE = NS > > udp[23:2] = 1 # QCLASS = IN