dnszeppelin

README

DnsZeppelin

Go library to capture DNS packets, based on https://github.com/Phillipmartin/gopassivedns. This library doesn't associate requests and responses of dns packets, and its used for raw logging.

This library support IPv4 and IPv6 protocols (plus fragmented), using TCP or UDP.

There is one implementation storing the data in a ClickHouse database at https://github.com/fdns/dnszeppelin-clickhouse

Updating dependencies

To update dependencies, use the official dep manager at https://github.com/golang/dep and run

$ dep ensure -update

Documentation

Index

• type CaptureOptions
• type DNSCapturer
  • func NewDNSCapturer(options CaptureOptions) DNSCapturer
  • func (capturer *DNSCapturer) Start()
• type DNSResult

Types

type CaptureOptions

type CaptureOptions struct {
	DevName                      string
	PcapFile                     string
	Filter                       string
	Port                         uint16
	GcTime                       time.Duration
	ResultChannel                chan<- DNSResult
	PacketHandlerCount           uint
	PacketChannelSize            uint
	TCPHandlerCount              uint
	TCPAssemblyChannelSize       uint
	TCPResultChannelSize         uint
	IPDefraggerChannelSize       uint
	IPDefraggerReturnChannelSize uint
	Done                         chan bool
}

type DNSCapturer

type DNSCapturer struct {
	// contains filtered or unexported fields
}

func NewDNSCapturer

func NewDNSCapturer(options CaptureOptions) DNSCapturer

func (*DNSCapturer) Start

func (capturer *DNSCapturer) Start()

type DNSResult

type DNSResult struct {
	Timestamp    time.Time
	DNS          mkdns.Msg
	IPVersion    uint8
	SrcIP        net.IP
	DstIP        net.IP
	Protocol     string
	PacketLength uint16
}