@alinari I know it's been a few years but if you can please explain more about 3cc10d4, doesn't the code follow normal DNS name compressed labels?

Add columns answers, authorties, and additionals, each of which which returns a comma delimeted list of qname, class and type for each RR in the response

For multi-valued columns like answers, I wonder if it would be more SQL-like to have a separate pseudo table e.g. dns_answers which you could join onto the dns table. There would need to be some unique key that joins the two (could just be pcap filename + offset)

This would allow you to more easily handle queries like: "show me all queries which resolved to A 1.2.3.4", which is difficult if the answer is a multi-valued, comma-separated list.

@candlerb Unless you need to do it in SQL, dnsjit will be able to easily do it with a custom Lua filter