Private/ConvertFrom-VBDNSName.ps1
|
# ============================================================ # FUNCTION : ConvertFrom-VBDNSName # VERSION : 1.0.0 # CHANGED : 2026-05-07 -- Initial build # AUTHOR : Vibhu Bhatnagar # PURPOSE : Decode DNS wire-format query names to FQDN # ENCODING : UTF-8 with BOM # ============================================================ <# .SYNOPSIS Decodes a DNS wire-format query name to a human-readable FQDN. .DESCRIPTION Windows DNS debug logs encode query names in wire format, e.g. (7)example(3)com(0). This function uses IndexOf/Substring loop (not regex) to decode the name. Each (n) prefix indicates the length of the following label segment. The (0) terminator ends the name and is not included in the output. This approach is intentionally faster than regex — measured at 15-20% overall speedup in the import pipeline when called on every PACKET line. .PARAMETER RawName The raw wire-format DNS name string from the debug log, e.g. (7)example(3)com(0). .OUTPUTS [string] Decoded FQDN (e.g. 'example.com'), or empty string for null/empty input, or the original string if it does not contain wire-format prefixes. .NOTES Version : 1.0.0 Author : Vibhu Bhatnagar Modified : 2026-05-07 Category : Private Called by: Invoke-VBDNSLogParser (hot loop — every PACKET line) #> function ConvertFrom-VBDNSName { [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true)] [AllowEmptyString()] [string]$RawName ) # Guard -- null or empty input if ([string]::IsNullOrWhiteSpace($RawName)) { return '' } # Guard -- no wire-format prefix present, return as-is if ($RawName[0] -ne '(') { return $RawName.Trim() } # Decode wire-format labels using IndexOf/Substring (no regex) $labels = [System.Collections.Generic.List[string]]::new(8) $pos = 0 $len = $RawName.Length while ($pos -lt $len -and $RawName[$pos] -eq [char]'(') { # Find closing parenthesis $close = $RawName.IndexOf(')', $pos) if ($close -lt 0) { break } # Extract the numeric length prefix $segLen = [int]$RawName.Substring($pos + 1, $close - $pos - 1) # (0) is the wire-format terminator -- stop here if ($segLen -eq 0) { break } # Advance past the closing parenthesis and extract label of declared length $labelStart = $close + 1 if ($labelStart + $segLen -gt $len) { break } $labels.Add($RawName.Substring($labelStart, $segLen)) $pos = $labelStart + $segLen } if ($labels.Count -eq 0) { return $RawName.Trim() } return [string]::Join('.', $labels) } |