doc/upgrade: note about dns address swap on responses

Document the change in DNS addresses for ticket 6400.

Ticket: https://redmine.openinfosecfoundation.org/issues/6400

diff --git a/doc/userguide/upgrade/8.0-dns-logging-changes.rst b/doc/userguide/upgrade/8.0-dns-logging-changes.rst
index 2ca0ef7d9bd1d4974ba7dc712623a83640a369f0..928a61f5691bed97e6f67c118e8014e2a0018b19 100644 (file)
--- a/doc/userguide/upgrade/8.0-dns-logging-changes.rst
+++ b/doc/userguide/upgrade/8.0-dns-logging-changes.rst
@@ -10,6 +10,10 @@ the ``dns`` object accross ``dns`` and ``alert`` objects.
 
 Ticket: https://redmine.openinfosecfoundation.org/issues/6281
 
+Additionally, version ``3`` DNS response messages will now use the IP
+address of the responder as the ``src_ip``, not the client, ticket:
+https://redmine.openinfosecfoundation.org/issues/6400
+
 The changes are summarized below:
 
 * DNS requests now have a type of ``request`` instead of ``query``.