I agree we will need a way to determine whether the plugin supports TCP or UDP or both without using reflection. Currently I have it pieced together with reflection (knowing it would need to change). I’ll look at moving the decoder logic over to the protos package; that sounds like the right place.
DNS is the protocol. I plan on using gopacket within the PluginProtocol implementation to do the low level packet parsing.
Thanks for the direction.