SDN RYU Controller-Read DNS Header Flags in DNS Amplification Reflection Attack

I implement an SDN network with an RYU controller. I simulate a DNS amplification reflection attack.

Now I need to recognize legitimate from illegitimate DNS responses by reading some flags in the DNS header.

Does anybody have an idea how it is possible to read DNS flags in the RYU controller?

Thank you