| Protocol Field           | pcre Writing Method  | Field Type | Field Description                        |
| :---------------- | :-------- | :------- | ------------------------------- |
| dns_len           | /         | Numeric value     | DNS request packet length |
| dns_id            | /         | Numeric value     | DNS packet identifier                   |
| dns_rr_name       | RR_NAME   | Character string   | Name of the data in the record resource        |
| dns_rr_name_len   | /         | Length     | Name length of the data in the record resource  |
| dns_query         | QUERY     | Character string   | Queried domain name content (after normalization)          |
| dns_query_len     | /         | Length     | Length of the queried domain name                |
| dns_raw_query     | RAW_QUERY | Character string   | Queried domain name content (before normalization)          |
| dns_raw_query_len | /         | Length     | Length of the queried domain name                |
| dns_rr_data_len   | /         | Numeric value     | Resource data length                  |
| dns_ar_count      | /         | Numeric value     | Number of additional records              |
| dns_ns_count      | /         | Numeric value     | Number of authoritative records        |

DNS Fields