analyze DNS protocol