[dnstelecom]

Fix capture timestamp handling and DNS matching correctness, while restoring throughput with targeted routing optimizations.

• Correct PCAPNG timestamp word ordering, binary/decimal resolution handling, and signed interface offsets. Preserve structural validation and bound buffer growth by received data.
• Include QCLASS and OPCODE in transaction identity and derive query/response direction from DNS QR.
• Preserve pending retries so out-of-order timestamps cannot incorrectly widen deduplication windows or lose valid matches.
• Support IPv6 extension headers and atomic fragments, enforce compression-pointer boundaries, and correctly consume TSIG Other Data.
• Preserve unknown QTYPE and response-code values in CSV and Parquet exports.
• Compact routing metadata and batch SeaHash updates while preserving existing hash values, shard assignments, and output order.
• Update architecture, protocol documentation, and benchmark results.

[Copilot]

🟡 Changes recommended

The new Parquet end-to-end test likely builds &str values via get_string(..).unwrap().clone() despite declaring Vec<(String, String)>, which can cause a compilation/type mismatch.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens protocol correctness across capture parsing and DNS transaction matching, while restoring throughput via routing optimizations, and updates docs/benchmarks to reflect the new correctness contract.

Changes:

• Fix PCAPNG stdin timestamp handling (word ordering, full binary/decimal if_tsresol, signed if_tsoffset) while keeping structural validation and bounded buffering.
• Improve DNS correctness: derive direction from DNS QR (including UDP/53 on both ends), include QCLASS/OPCODE in matcher identity, retain pending retries for non-monotonic captures, and harden IPv6/TSIG/QNAME handling.
• Preserve unknown QTYPE/RCODE values end-to-end (CSV/Parquet/serde) and reduce routing overhead by buffering flow-hash writes while preserving shard assignment/output order.

File summaries

File	Description
tests/end_to_end.rs	Adds an end-to-end CSV/Parquet round-trip test for unknown QTYPE/RCODE formatting.
src/test_support.rs	Adjusts DNS test packet helper to set QR for packets sourced from UDP/53.
src/parquet_writer.rs	Writes protocol text columns using Cow to avoid forcing allocations for known values.
src/packet_parser.rs	Introduces a parser-owned PCAPNG stdin reader for correct timestamp conversion and maintains structural validation.
src/packet_parser_wire_tests.rs	Adds independent wire-level PCAPNG fixtures/tests covering timestamp/resolution/offset/validation edge cases.
src/dns_processor/types.rs	Extends matcher identity (QCLASS/OPCODE) and adds retry retention payload plus mutable timeline access.
src/dns_processor/tests.rs	Updates matcher tests for new identity fields and adds regression coverage for retry regrouping behavior.
src/dns_processor/pipeline.rs	Buffers flow-hash writes (SeaHash) to reduce routing overhead; adds regression and hash-equivalence tests.
src/dns_processor/parser.rs	Enforces QR-based direction and port validation, supports IPv6 extension chains/atomic fragments, consumes TSIG Other Data, and tightens compression-pointer boundaries.
src/dns_processor/matcher.rs	Preserves pending retries for non-monotonic captures and repartitions earlier-attempt regressions without reopening finalized transactions.
src/custom_types.rs	Preserves unknown QTYPE/RCODE numeric identity in formatting and serde round-trips via Cow.
README.md	Updates user-facing protocol/matcher behavior and export formatting guarantees.
docs/rfc/0005-dual-path-pcap-parsing.md	Documents PCAPNG timestamp ownership and new IPv6 boundary behavior.
docs/rfc/0004-forward-only-matcher.md	Documents updated matcher identity, retry regrouping behavior, and determinism constraints.
docs/architecture.md	Updates architecture notes for buffered flow hashing, PCAPNG stdin parsing, IPv6 traversal, and retry retention.
Cargo.toml	Bumps crate version and adds byteorder_slice dependency used for stateless pcapng decoding.
Cargo.lock	Locks updated crate version and new dependency.
benches/README.md	Adds benchmark/report doc entry for the audit.
benches/protocol-correctness-audit.md	Adds benchmark results and validation notes for the final audit implementation.

Review details

• Files reviewed: 18/19 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.