This configuration enables one-packet DNS detection on arbitrary UDP ports:

  --cfg=dns,custom_port,0

The canonical captures are stored in tests/cfgs/default/pcap/. This directory
contains symbolic links to those captures and configuration-specific expected
results.

dns_on_port_80_query_only.pcapng contains one valid DNS A query sent to UDP
port 80. It verifies that arbitrary-port detection supports query-only and
asymmetric captures without waiting for a response.

dns_any_port_edge_cases.pcapng contains six one-packet flows. The source
address identifies each case:

  192.0.2.1  Root QNAME.
  192.0.2.2  Two questions; the second QNAME uses compression.
  192.0.2.3  Uncompressed QNAME at the RFC 1035 255-octet wire limit.
  192.0.2.4  Truncated QNAME with no complete QTYPE/QCLASS trailer.
  192.0.2.5  Reserved 0x40 label encoding.
  192.0.2.6  Non-DNS application data with a valid DNS-shaped prefix.

With the default configuration, all of these flows remain Unknown because
they use non-standard ports. With the current dns.custom_port=0 baseline, all
six edge-case flows are classified as DNS. A follow-up hardening change should
continue accepting the root, compressed, maximum-length, query-only, and
DNS-shaped cases while rejecting the truncated and reserved-label cases.

The DNS-shaped non-DNS case intentionally remains a positive match. It records
the fundamental limitation that one-packet stateless geometry cannot prove
that arbitrary-port traffic was generated by a DNS implementation.
