Skip to content

measurement-factory/dnstop

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
September 12, 2014 22:14
December 24, 2002 17:32
March 15, 2021 20:24
February 26, 2018 15:15
April 29, 2008 05:57

DNSTOP: STAY ON TOP OF YOUR DNS TRAFFIC

dnstop is a libpcap application (like tcpdump) that displays various tables of DNS traffic on your network. Currently dnstop displays tables of:

  • Source IP addresses
  • Destination IP addresses
  • Query types
  • Response codes
  • Opcodes
  • Top level domains
  • Second level domains
  • Third level domains
  • etc...

dnstop supports both IPv4 and IPv6 addresses.

To help find especially undesirable DNS queries, dnstop provides a number of filters. The filters tell dnstop to display only the following types of queries:

  • For unknown/invalid TLDs
  • A queries where the query name is already an IP address
  • PTR queries for RFC1918 address space
  • Responses with code REFUSED
  • Responses with code SERVFAIL
  • Responses with code NXDOMAIN

dnstop can either read packets from the live capture device, or from a tcpdump savefile.

See also http://dns.measurement-factory.com/tools/dnstop/.

For compatibility with musl libc, define CFLAGS=-D_GNU_SOURCE during configure.

About

Stay on top of your DNS traffic

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published