"TRUE","Responses","dns.flags.response == 1","DNS responses"
"TRUE","Errors","dns.flags.rcode != 0","DNS responses whose reply code is not No error"
"TRUE","Slow","dns.time > 0.5","DNS responses slower than 0.5 seconds (500 ms)"
