# Weird etdl+1

**URL:** <https://discuss.elastic.co/t/weird-etdl-1/200528>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 21, 2019, 12:48pm UTC](https://discuss.elastic.co/t/weird-etdl-1/200528 "2019-09-21T12:48:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [September 21, 2019, 12:48pm UTC](https://discuss.elastic.co/t/weird-etdl-1/200528/1 "2019-09-21T12:48:09Z")

</div>

Found a weird etdl+1 value in Packetbeat dns data:

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0aab4840053b1814e18c7bb492a9c8b60d9a93ae.png)

Seems not normal to create this field for an ip?

```
"question": {
  "name": "127.0.0.1:5432",
  "type": "A",
  "class": "IN",
  "etld_plus_one": "0.1:5432"
},
```

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [September 23, 2019, 4:59pm UTC](https://discuss.elastic.co/t/weird-etdl-1/200528/2 "2019-09-23T16:59:14Z")

</div>

Hello, thanks for posting the packetbeat question. It looks like `dns.question.name` is incorrect which causes `dns.question.etld_plus_one` to be incorrect. Which version of packetbeat are you running? Do you see this same behavior on all your packetbeat deployments? Are you able to resolve host names to IP fine in this environment?

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [September 23, 2019, 5:07pm UTC](https://discuss.elastic.co/t/weird-etdl-1/200528/3 "2019-09-23T17:07:43Z")

</div>

Hello Michael,

Packetbeat version: 7.3.2, I'm not seeing this on other packetbeat dns data.. This is on my home lab, dns is my ips's dns servers.. Working on some other issues atm. Just thought I'd let you know. Maybe it only happens on 127.0.0.1? Anyway the etdl\_plus\_one is definitely incorrect and should not contain half an ip address and a port.

Tx

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2019, 5:17pm UTC](https://discuss.elastic.co/t/weird-etdl-1/200528/4 "2019-10-21T17:17:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.