with erlang you can parse the dns-header like so:

,----

| %% extract dns-header fields from a raw packet.

| parse_dns_header(raw_packet) ->

| <<

| ID:16,

| QR:1, OPCODE:4, AA:1, TC:1, RD:1, RA:1, Z:3, RCODE:4,

| QDCOUNT:16,

| ANCOUNT:16,

| NSCOUNT:16, ARCOUNT:16,

| Tail/binary

| >> = raw_packet,

|

| {#dns_header_record {

| id = ID,

| qr = QR, opcode = OPCODE, aa = AA, tc = TC, rd = RD, ra = RA, z = Z, rcode = RCODE,

| qdcount = QDCOUNT,

| ancount = ANCOUNT,

| nscount = NSCOUNT,

| arcount = ARCOUNT

| }, Tail}.

|

`----

almost verbatim 'transliteration' of sec:4.1.1 of 1035 :)