[dsc] qtype dataset is empty

[Duane Wessels]

On Thu, 21 May 2009, Andrew Ruthven wrote:

> I've applied it, but it didn't produce any output.  However, I played
> around with tcpdump and it seems that the required bpf filter has
> changed.  Using "vlan 1" no longer caught in-bound packets (even though
> they're in vlan 1).  I removed that and now I'm seeing Qtypes again!

I've experience similar strangeness with VLANs and BPF as well.

But originally you said that you were getting data in other datasets
and that only qtype data was empty.  Was that really the case??

The VLAN checks are applied before any DNS message inspection.  I guess
I could believe that you were seeing some IP-layer datasets but if
the filter was choking on VLANs then all of the DNS datasets should
have been empty I think.

DW