C++ Native Functions: `com.ibm.streamsx.network.dns`

Specialized toolkits - release 4.3.1.0-prod20190605 > com.ibm.streamsx.network 3.2.1 > com.ibm.streamsx.network.dns > C++ Native Functions

This page documents native functions that can be invoked from SPL, including the SPL interfaces that can be used to invoke each of the native functions.

Functions

public uint32 CAPTURE_MICROSECONDS()

This function returns the number of microseconds since the value of the CAPTURE_SECONDS() function until the current packet was captured, according to the system clock on the machine that captured it.

public uint32 CAPTURE_SECONDS()

This function returns the number of seconds since the beginning of the Unix epoch (midnight on January 1st, 1970 in Greenwich, England) until the current packet was captured, according to the system clock on the machine that captured it.

public uint64 CAPTURE_TSC_MICROSECONDS()

This function returns the value of the machine's timestamp counter when the packet was captured, that is, the number of microseconds since the machine was booted. Note that unlike the CAPTURE_SECONDS() and CAPTURE_MICROSECONDS() functions, this function's value is not relative to the Unix 'epoch'.

public list<uint16> DNS_ADDITIONAL_CLASSES()

This parser result function returns a list of the 'class' fields in the 'additional' resource records in the current message.

public uint16 DNS_ADDITIONAL_COUNT()

This parser result function returns the number of 'additional' resource records in the current message.

public list<rstring> DNS_ADDITIONAL_DATA()

This parser result function returns a list of the 'data' fields in the 'additional' resource records in the current message. For resource records containing multiple fields, such as SOA records, only the first field is returned.

public list<rstring> DNS_ADDITIONAL_DATA(rstring)

public list<rstring> DNS_ADDITIONAL_NAMES()

This parser result function returns a list of the 'name' fields in the 'additional' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_ADDITIONAL_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'additional' resource records in the current message.

public list<uint16> DNS_ADDITIONAL_TYPES()

This parser result function returns a list of the 'type' fields in the 'additional' resource records in the current message.

public rstring DNS_ALL_FIELDS(rstring, rstring, rstring)

This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from all DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter.

public rstring DNS_ALL_FIELDS(rstring, rstring, rstring, list<uint16>)

This parser result function returns a string containing 'flattened' representation of the DNS packet, including selected fields from the IP and UDP headers, all fields from the DNS header, and all fields from seleccted DNS resource records, represented as appropriate, separated by the specified record and field delimiters, and for SOA resource records, a subfield delimiter. DNS resource records are selected by specifying DNS types in a list of unsigned 16-bit integers as the fourth parameter of the function.

public uint16 DNS_ALL_FLAGS()

This parser result function returns a 16-bit value containing all of the DNS header flags from the current message. The value is in host byte order, so, for example, DNS_ALL_FLAGS()& 0x8000 == 0x8000 has the same value as DNS_RESPONSE_FLAG(), DNS_ALL_FLAGS() >> 11 & 0x000F has the same value as DNS_OPCODE(), and DNS_ALL_FLAGS() & 0x000F has the same value as DNS_RESPONSE_CODE().

public rstring DNS_ANSWER_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as a string value, or an empty string if not.

public list<rstring> DNS_ANSWER_ADDRESSES()

This parser result function returns a list of the 'data' fields in the 'answer' resource records that have a 'type' value of '1' or '28' (meaning, the answer is an IP version 4 or version 6 address from a type 'A' or 'AAAA' record, respectively), as string values.

public rstring DNS_ANSWER_CANONICAL()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '5' (meaning, the answer is a canonical domain name from a type 'CNAME' record), or an empty string if not.

public list<uint16> DNS_ANSWER_CLASSES()

This parser result function returns a list of the 'class' fields in the 'answer' resource records in the current message.

public uint16 DNS_ANSWER_COUNT()

This parser result function returns the number of 'answer' resource records in the current message.

public list<rstring> DNS_ANSWER_DATA()

This parser result function returns a list of the 'data' fields in the 'answer' resource records in the current message.

public uint32 DNS_ANSWER_IPV4_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '1' (meaning, the answer is an IP version 4 address from a type 'A' record), as a binary value, or zero if not.

public list<uint32> DNS_ANSWER_IPV4_ADDRESSES()

This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '1' (meaning, the answers are IP version 4 addresses from type 'A' records), as a list of binary values.

public list<uint8>[16] DNS_ANSWER_IPV6_ADDRESS()

This parser result function returns the 'data' field of the first 'answer' resource record, if there is one with a 'type' value of '28' (meaning, the answer is an IP version 6 address from a type 'AAAA' record), as a binary value, or zero if not.

public list<list<uint8>[16]> DNS_ANSWER_IPV6_ADDRESSES()

This parser result function returns the 'data' fields of the 'answer' resource records that have 'type' values of '28' (meaning, the answers IP version 6 addresses from type 'AAAA' records), as a binary values.

public list<rstring> DNS_ANSWER_NAMES()

This parser result function returns a list of the 'name' fields in the 'answer' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_ANSWER_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'answer' resource records in the current message.

public list<uint16> DNS_ANSWER_TYPES()

This parser result function returns a list of the 'type' fields in the 'answer' resource records in the current message.

public boolean DNS_AUTHORITATIVE_FLAG()

This parser result function returns true if the 'authoritative' flag is set in the current message, or false if not.

public blob DNS_EXTRA_DATA()

This parser result function returns any extra data in the DNS message that follows the last resource record. Note that the parseError() function returns 'true' if there is any extra data following the last resource record, even though no errors were found in any resource record, and the parseErrorCode() function returns '122'.

public uint16 DNS_IDENTIFIER()

This parser result function returns the DNS client's request correlator in the current message, and returned by the server in its response.

public int32 DNS_INCOMPATIBLE_FLAGS()

This DNS parser result function returns a non-zero integer to indicate that an encoding error was found while decoding the current packet, or zero if no enoding errors were found. The error codes are:

1 indicates that the Authoritative flag is set in the DNS header but the Response flag is not set.
2 indicates that the Truncated flag is set in the DNS header but not the Response flag is not set.
3 indicates that the Authoritative and Truncated flags in the DNS header are both set.
4 indicates that the Authoritative, Truncated, Recursion Desired, and Recursion Available flags in the DNS header are all set.

public list<uint16> DNS_NAMESERVER_CLASSES()

This parser result function returns a list of the 'class' fields in the 'name server' resource records in the current message.

public uint16 DNS_NAMESERVER_COUNT()

This parser result function returns the number of 'name server' resource records in the current message.

public list<rstring> DNS_NAMESERVER_DATA()

This parser result function returns a list of the 'data' fields in the 'name server' resource records in the current message. For resource records containing multiple fields, such as SOA records, only the first field is returned.

public list<rstring> DNS_NAMESERVER_DATA(rstring)

public list<rstring> DNS_NAMESERVER_NAMES()

This parser result function returns a list of the 'name' fields in the 'name server' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public list<uint32> DNS_NAMESERVER_TTLS()

This parser result function returns a list of the 'time to live' fields in the 'name server' resource records in the current message.

public list<uint16> DNS_NAMESERVER_TYPES()

This parser result function returns a list of the 'type' fields in the 'name server' resource records in the current message.

public uint8 DNS_OPCODE()

This parser result function returns the operation code requested by the DNS client in the current message, for example,

'1' for standard queries,
'2' for inverse queries, or
'3' for server status requests.

public uint16 DNS_QUESTION_CLASS()

This parser result function returns the 'class' field of the first 'question' resource record in the current message, for example, '1' for Internet adddresses ('IN' records),

public list<uint16> DNS_QUESTION_CLASSES()

This parser result function returns a list of the 'class' fields in the 'question' resource records in the current message.

public uint16 DNS_QUESTION_COUNT()

This parser result function returns the number of 'question' resource records in the current message.

public rstring DNS_QUESTION_NAME()

This parser result function returns the 'name' field of the first 'question' resource record in the current message, if there is one, or an empty string if not. Note that if the DNS message does contain a 'question' resource record, and the name is encoded incorrecty, this function may return an empty or truncated string. In this case, the parseError() function will return true.

public list<rstring> DNS_QUESTION_NAMES()

This parser result function returns a list of the 'name' fields in the 'question' resource records in the current message. Note that if any of the names are encoded incorrectly, this function may return an empty or truncated list, and some or all of the names may be empty or truncated. In this case, the parseError() function will return true.

public uint16 DNS_QUESTION_TYPE()

This parser result function returns the 'type' field of the first 'question' resource record in the current message, for example:

'1' for IP version 4 address to domain name lookup ('A' records),
'5' for domain name to canonical domain name lookup ('CNAME' records),
'12' for domain name to IP address lookup ('TXT' records), or
'28' for IP version 6 address to domain name lookup ('AAAA' records).

public list<uint16> DNS_QUESTION_TYPES()

This parser result function returns a list of the 'type' fields in the 'question' resource records in the current message.

public uint8 DNS_RESPONSE_CODE()

This parser result function returns the response code from the DNS server in the current message, for example,

'0' for OK,
'1' for Format Error,
'2' for Server Failure,
'3' for Name Error,
'4' for not implemented, or
'5' for Server Refused.

public boolean DNS_RESPONSE_FLAG()

This parser result function returns true if the current message is a response sent by a DNS server, or false if it is a request sent by a DNS client.

public boolean DNS_TRUNCATION_FLAG()

This parser result function returns true if the 'truncation' flag is set in the current message, or false if not.

public list<uint8>[6] ETHER_DST_ADDRESS()

This function returns the ethernet destination address of the current packet.

public uint64 ETHER_DST_ADDRESS_64()

This function returns the ethernet destination address of the current packet in the 48 low-order bits of a uint64.

public uint16 ETHER_PROTOCOL()

This function returns the ethernet protocol (that is, the EtherType) of the current packet, for example, '2048' for IP version 4, or '34,525' for IP version 6.

public list<uint8>[6] ETHER_SRC_ADDRESS()

This function returns the ethernet source address of the current packet.

public uint32 IPV4_DST_ADDRESS()

This function returns the IP version 4 destination address of the current packet, if it has one, or zero otherwise.

public uint32 IPV4_SRC_ADDRESS()

This function returns the IP version 4 source address of the current packet, if it has one, or zero otherwise.

public list<uint8>[16] IPV6_DST_ADDRESS()

This function returns the IP version 6 destination address of the current packet, if it has one, or an empty list otherwise.

public list<uint8>[16] IPV6_SRC_ADDRESS()

This function returns the IP version 6 source address of the current packet, if it has one, or an empty list otherwise.

public boolean IP_DONT_FRAGMENT()

This function returns the IP "don't fragment" flag of the current packet. When a sender sets this flag in a packet, it prohibits routers from fragmenting the packet in transit. If the packet's length exceeds the maximum size of a link, it will be discarded by the router instead of being fragmented.

public uint16 IP_FRAGMENT_OFFSET()

This function returns the IP "fragment offset" field of the current packet, multiplied by eight, When a router fragments a packet, it stores the offset from the front of the packet to the front of the fragment, measured in eight-byte steps, in each fragment. That is, the size of each fragment is always a multiple of eight bytes, and the value stored is the offset in bytes, divided by eight. This function returns that value, multiplied by eight, so that it gives the offset from the front of the packet to the front of the fragment in bytes.

public uint32 IP_IDENTIFIER()

This function returns the IP identifier of the current packet. When a packet is fragmented in transit, this identifer is copied into all of the fragments. The receiver combines this identifier with the packet's source and destination addresses to gather the fragments, and uses the fragment offset (see the IP_FRAGMENT_OFFSET() function) to reassemble them into original packet.

public boolean IP_MORE_FRAGMENTS()

This function returns the IP "more fragments" flag of the current packet. When a router fragments a packet, it sets this flag in all fragments except the last one.

public uint8 IP_PROTOCOL()

This function returns the IP protocol of the current packet, for example, '6' for TCP, or '17' for UDP, or zero if the ethernet packet does not contain an IP packet.

public uint8 IP_VERSION()

This function returns the IP version of the current packet ('4' for IP version 4, or '6' for IP version 6), if the ethernet packet contains an IP packet, or zero otherwise.

public blob PACKET_DATA()

This function returns the network data in the current packet, including all network headers. Note that the data may have been truncated when the packet was captured.

public uint32 PACKET_LENGTH()

This function returns the number of bytes of network data in the current packet, including all network headers. Note that this value may be larger than the length of the binary data returned by the PACKET_DATA() function if the packet was truncated when it was captured.

public blob PAYLOAD_DATA()

This function returns the payload data in the current packet, excluding all network headers. Note that the data may have been truncated when the packet was captured.

public uint32 PAYLOAD_LENGTH()

This function returns the number of bytes of payload data in the current packet, excluding all network headers. Note that this value may be larger than the length of the binary data returned by the PAYLOAD_DATA() function if the packet was truncated when it was captured.

public boolean RATE_LIMITED()

This function returns false when an amount of time between packets has passed such that the rate is limited to the value given in the rateLimit paramater.

public uint16 UDP_DST_PORT()

This function returns the UDP destination port number of the current packet, if it has one, or zero otherwise.

public boolean UDP_PORT(uint16)

This function returns true if the current packet is a UDP packet and the argument matches its source or destination port, or false otherwise.

public uint16 UDP_SRC_PORT()

This function returns the UDP source port number of the current packet, if it has one, or zero otherwise.

public list<uint16> VLAN_TAGS()

This function returns a list of 0 to N VLAN tags found in the current packet.

public uint64 bytesProcessed()

This function returns the number of bytes of network data processed by the operator since it started, including the current packet, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.

public uint64 bytesReceived()

This function returns the number of bytes received from the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketLiveSource and DNSPacketFileSource operators.

public uint64 metricsIntervalBytesProcessed()

This function returns the number of bytes of network data processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.

public uint64 metricsIntervalBytesReceived()

This function returns the number of bytes received from the network interface during the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketLiveSource and DNSPacketFileSource operators.

public float64 metricsIntervalElapsed()

This function returns the duration of the most recent metrics interval, in seconds with a resolution of at least microseconds, if there is one, or zero if not.

public uint64 metricsIntervalMaxQueueDepthSW()

This function returns the software receive queue (if implemented) high water mark from the most recent metrics interval. Otherwise, returns 0.

public uint64 metricsIntervalPacketsDropped()

This function returns the number of packets dropped by the network interface during the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketFileSource operator.

public uint64 metricsIntervalPacketsDroppedSW()

This function returns the number of packets dropped by the software packet receive queue (if implemented) in the most recent metrics interval. Otherwise, returns 0.

public uint64 metricsIntervalPacketsProcessed()

This function returns the number of network packets processed by the operator during the most recent metrics interval, excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.

public uint64 metricsIntervalPacketsReceived()

This function returns the number of packets received from the network interface during the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketFileSource operator.

public boolean metricsUpdated()

This function returns true for the first tuple produced after a new metrics interval begins, and returns false for all subsequent tuples produced in the same metrics interval.

public uint64 packetsDropped()

This function returns the number of packets dropped by the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketFileSource operator.

public uint64 packetsDroppedSW()

This function returns the total number of packets dropped by the software packet receive queue (if implemented). Otherwise, returns 0.

public uint64 packetsProcessed()

This function returns the number of network packets processed by the operator since it started, including the current packet, but excluding any packets that were ignored by the input filter, if the inputFilter parameter was specified.

public uint64 packetsReceived()

This function returns the number of packets received from the network interface since the operator started, as of the most recent metrics interval, if there is one, or zero if not. This function always returns zero for the DNSPacketFileSource operator.

public boolean parseError()

This DNS parser result function returns true if an encoding error was detected while decoding the current packet, or false otherwise. Note that a value of false does not necessarily mean the packet has no encoding errors, since the operator only decodes the fields needed.

public int32 parseErrorCode()

102 for 'label overruns packet': The length of an uncompressed domain name label extends beyond the end of the DNS message. The packet containing the DNS message may have been truncated.
103 for 'label compression length overruns packet': The length field of a compressed domain name label extends beyond the end of the DNS message. The packet containing the DNS message may have been truncated.
104 for 'label compression offset underruns packet': The offset of a compressed domain name label points before the beginning of the DNS message. The sender misencoded the domain name.
105 for 'label compression offset forward reference': The offset of a compressed domain name label points beyond the current label. The sender misencoded the domain name.
106 for 'label compression offset loop': The offset of a compressed domain name label points to itself. The sender misencoded the domain name.
107 for 'label flags invalid': The flag field of a compressed domain name label is invalid. The sender misencoded the domain name.
108 for 'label limit exceeded': A compressed domain name contains too many labels. The sender misencoded the domain name.
110 for 'resource record missing': The DNS message contains fewer resource records than the 'count' fields in the message header indicate. The DNS message may have been truncated.
111 for 'question resource record truncated': The DNS 'question' resource record was truncated. The packet containing the message was probably truncated.
112 for 'resource record truncated': A DNS resource record was truncated. The packet containing the DNS message was probably truncated.
113 for 'resource record data truncated': The 'rdata' field of a DNS resource record was truncated. The packet containing the DNS message was probably truncated.
114 for 'invalid address family': The 'class' field of a DNS resource record was neither 'AF_INET' nor 'AF_INET6' (meaning IP version 4 or IP version 6, respectively).
116 for 'message too short': The DNS message is shorter than the length of the DNS header. The packet probably does not contain a DNS message.
117 for 'resource record counts too large': A 'count' field in the DNS message header is larger than the maximum supported. The packet probably does not contain a DNS message.
118 for 'text string overruns resource record': The text string length in a DNS 'TXT' resource record is larger than the record's data field. The sender misencoded the resource record.
119 for 'missing data in resource record': The data field of a resource record is too short; some fields may be truncated or missing entirely. The sender misencoded the resource record.
120 for 'extra data in resource record': The data field of a resource record is too long; there is unexpected data following the last field. The sender misencoded the resource record.
121 for 'label compression offset invalid': The offset of a compressed domain name label does not point to a previous label. The sender misencoded the domain name.
122 for 'extra data following resource records': There are extra bytes of data in the DNS message following the last resource record. The sender probably miscalculated the packet length.
123 for 'resource record data too long': The 'data length' field of a resource record is unreasonably large. The packet probably does not contain a DNS message.

Note: RFC 1035 explains the format of DNS messages; in particular, section 4.1.4 explains the format of compressed domain names in DNS messages.

public rstring parseErrorDescription()

This DNS parser result function returns a description of an encoding error found while decoding the current packet, or an empty string if no enoding errors were found.

public uint32 parseErrorOffset()

This DNS parser result function returns the offset from the beginning of the message to the encoding error found, or zero if no encoding errors were found.

C++ Native Functions: com.ibm.streamsx.network.dns

C++ Native Functions: `com.ibm.streamsx.network.dns`