Improve handling of nested compression pointers and add columns for multiple answers, authorities and additionals.

[alinari]

No description provided.

[jelu]

@alinari I know it's been a few years but if you can please explain more about 3cc10d4, doesn't the code follow normal DNS name compressed labels?

[candlerb]

Add columns answers, authorties, and additionals, each of which which returns a comma delimeted list of qname, class and type for each RR in the response

For multi-valued columns like answers, I wonder if it would be more SQL-like to have a separate pseudo table e.g. dns_answers which you could join onto the dns table. There would need to be some unique key that joins the two (could just be pcap filename + offset)

This would allow you to more easily handle queries like: "show me all queries which resolved to A 1.2.3.4", which is difficult if the answer is a multi-valued, comma-separated list.

[jelu]

@candlerb Unless you need to do it in SQL, dnsjit will be able to easily do it with a custom Lua filter