# Release notes v1.2.0.0 (2026-01-25)

LLMS index: [llms.txt](/llms.txt)

---

## Added

* **NEW**: Multi-line record processing for DNS PACKET detail blocks
  * PACKET context entries can now include detailed TCP/UDP connection information and DNS message structure
  * Detail blocks are parsed into structured JSON format in the new `Details` column
  * Includes: Socket info, remote address/port, timing data, message structure (XID, Flags, QCOUNT, etc.)
  * DNS sections (QUESTION, ANSWER, AUTHORITY, ADDITIONAL) are captured with full record details
  * Encoded domain names in detail blocks are automatically converted to FQDN format
* **NEW**: `Details` column in CSV output
  * Contains structured JSON data for PACKET entries with detail blocks
  * Empty for PACKET entries without details and all non-PACKET contexts
  * Enables deep packet analysis and forensic investigation of DNS queries/responses
* **NEW**: `NoDetailsParsing` switch parameter for performance optimization
  * Skips expensive JSON parsing of PACKET detail blocks
  * ***Can improve*** processing speed by **30-50%** for logs with many detail blocks
  * Use when processing very large files (100MB+) and detailed packet structure is not needed
  * Detail blocks are still collected in Information column, but Details column remains empty
* **NEW**: Multi-line continuation support for non-PACKET contexts
  * EVENT, Note, DSPoll, and other contexts can now span multiple lines
  * Indented continuation lines are automatically joined to the main record's Information field
  * Preserves complete error messages, zone updates, and diagnostic output
* **NEW**: `ContextFilter` recognizes additional context types: `DSPoll`, `Init`, `Lookup`, `Recurse`, `Remote`, `Tombstone`
  * Effect: `Convert-DNSDebugLogFile` can now include/exclude these diagnostic and lifecycle entries via `-ContextFilter`
* **NEW**: Statistics output now includes two dedicated files
  * `_Statistic.csv`: Daily record counts per context type (Date, Context, Count, ComputerName)
  * `_PacketStatistic.csv`: Daily PACKET counts by client/protocol/direction/type (Date, ClientIP, Protocol, Direction, QuestionType, Count, ComputerName)
  * Benefit: More focused reporting (operational context volume vs. DNS traffic breakdown)
* JSON generation for PACKET detail blocks is optimized for performance (manual parsing instead of regex)

## Changed

* **BREAKING**: CSV output now includes 18 columns (added `Details` column before `ComputerName`)
  * New column order: DateTime, ThreadId, Context, PacketId, Protocol, Direction, ClientIP, Xid, Type, Opcode, FlagsHex, FlagsChar, ResponseCode, QuestionType, QuestionName, Information, **Details**, ComputerName
  * Impact: Scripts that rely on column positions must be updated
  * Benefit: Rich packet analysis capabilities without changing existing Information column behavior
* Data line processing refactored to read all lines into memory for efficient multi-line record detection
  * Performance: Minimal impact due to optimized List<string> usage
  * Benefit: Enables accurate lookahead for detail blocks and continuation lines
* Question names that are missing or encoded as empty are now handled gracefully (no parse errors); CSV output will contain an empty QuestionName field when absent

## Improved

* `Convert-DNSDebugLogFile` parsing is more resilient: stricter line validation and improved extraction reduce spurious/invalid rows from malformed logs while preserving the CSV/statistic output format
* PACKET context detection distinguishes between simple queries and queries with detail blocks
* Empty lines after PACKET entries without details are properly skipped
* Domain name decoding in detail blocks uses existing `ConvertTo-Fqdn` function for consistency

## Performance

* Processing speed maintained for logs without detail blocks
* `NoDetailsParsing` switch provides 30-50% speed improvement when JSON parsing is not needed
* Efficient state management during multi-line record processing
* Optimized string operations (TrimStart, Join) instead of regex for continuation line handling

## Notes

* These changes are designed to be backward compatible for normal usage. If you rely on an exact set of context names or previously-strict parsing behavior, please validate downstream scripts
* The new `Details` column is always present in CSV output; use `NoDetailsParsing` to keep it empty for performance
* Existing scripts that parse CSV by column position need to account for the new `Details` column (position 17, before ComputerName)