implement #78 dns filters

integration_tests/output-templates/dns_ipv4_tcp.Darwin.json

@@ -1 +1 @@
-{"5m":{"dns":{"period":{"length":7,"start_ts":1567706433},"top_nxdomain":[],"top_qname2":[{"estimate":420,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":"wWnyafx.test.com"},{"estimate":2,"name":".6RL.test.com"},{"estimate":2,"name":".LdmqNq.test.com"},{"estimate":2,"name":".UbuZpGD.test.com"},{"estimate":2,"name":".rZ4.test.com"},{"estimate":2,"name":".mTIoCZeUb8.test.com"},{"estimate":2,"name":"UlUoHV.test.com"},{"estimate":2,"name":".de0xnQUa3.test.com"},{"estimate":2,"name":".bp5MFj.test.com"},{"estimate":2,"name":".Sl2l.test.com"}],"top_qtype":[{"estimate":100,"name":"AAAA"},{"estimate":66,"name":"NS"},{"estimate":60,"name":"A"},{"estimate":60,"name":"SOA"},{"estimate":56,"name":"MX"},{"estimate":46,"name":"TXT"},{"estimate":32,"name":"CNAME"}],"top_rcode":[{"estimate":210,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"44495"},{"estimate":2,"name":"39127"},{"estimate":2,"name":"42695"},{"estimate":2,"name":"40281"},{"estimate":2,"name":"46399"},{"estimate":2,"name":"35805"},{"estimate":2,"name":"37805"},{"estimate":2,"name":"42397"},{"estimate":2,"name":"45847"},{"estimate":2,"name":"35287"}],"wire_packets":{"deep_samples":420,"ipv4":420,"ipv6":0,"noerror":0,"nxdomain":0,"queries":210,"refused":0,"replies":210,"srvfail":0,"tcp":420,"total":420,"udp":0},"xact":{"counts":{"timed_out":0,"total":210},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":210}}},"packets":{"deep_samples":2100,"in":2100,"ipv4":2100,"ipv6":0,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706433},"tcp":2100,"top_ASN":[{"estimate":2100,"name":"Unknown"}],"top_geoLoc":[{"estimate":2100,"name":"Unknown"}],"top_ipv4":[{"estimate":2100,"name":"127.0.0.1"}],"top_ipv6":[],"total":2100,"udp":0}}}
+{"5m":{"dns":{"period":{"length":7,"start_ts":1567706433},"top_nxdomain":[],"top_qname2":[{"estimate":420,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":"wWnyafx.test.com"},{"estimate":2,"name":".6RL.test.com"},{"estimate":2,"name":".LdmqNq.test.com"},{"estimate":2,"name":".UbuZpGD.test.com"},{"estimate":2,"name":".rZ4.test.com"},{"estimate":2,"name":".mTIoCZeUb8.test.com"},{"estimate":2,"name":"UlUoHV.test.com"},{"estimate":2,"name":".de0xnQUa3.test.com"},{"estimate":2,"name":".bp5MFj.test.com"},{"estimate":2,"name":".Sl2l.test.com"}],"top_qtype":[{"estimate":100,"name":"AAAA"},{"estimate":66,"name":"NS"},{"estimate":60,"name":"A"},{"estimate":60,"name":"SOA"},{"estimate":56,"name":"MX"},{"estimate":46,"name":"TXT"},{"estimate":32,"name":"CNAME"}],"top_rcode":[{"estimate":210,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"44495"},{"estimate":2,"name":"39127"},{"estimate":2,"name":"42695"},{"estimate":2,"name":"40281"},{"estimate":2,"name":"46399"},{"estimate":2,"name":"35805"},{"estimate":2,"name":"37805"},{"estimate":2,"name":"42397"},{"estimate":2,"name":"45847"},{"estimate":2,"name":"35287"}],"wire_packets":{"deep_samples":420,"filtered":0,"ipv4":420,"ipv6":0,"noerror":0,"nxdomain":0,"queries":210,"refused":0,"replies":210,"srvfail":0,"tcp":420,"total":420,"udp":0},"xact":{"counts":{"timed_out":0,"total":210},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":210}}},"packets":{"deep_samples":2100,"in":2100,"ipv4":2100,"ipv6":0,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706433},"tcp":2100,"top_ASN":[{"estimate":2100,"name":"Unknown"}],"top_geoLoc":[{"estimate":2100,"name":"Unknown"}],"top_ipv4":[{"estimate":2100,"name":"127.0.0.1"}],"top_ipv6":[],"total":2100,"udp":0}}}

integration_tests/output-templates/dns_ipv4_tcp.Linux.json

@@ -1 +1 @@
-{"5m":{"dns":{"period":{"length":7,"start_ts":1567706433},"top_nxdomain":[],"top_qname2":[{"estimate":420,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".lMw.test.com"},{"estimate":2,"name":".rZ4.test.com"},{"estimate":2,"name":"ZX0A4K.test.com"},{"estimate":2,"name":".6cR5fxGGfF.test.com"},{"estimate":2,"name":".lk06eYI2ck.test.com"},{"estimate":2,"name":".2at.test.com"},{"estimate":2,"name":".gHsieFqf.test.com"},{"estimate":2,"name":".uuteIwE.test.com"},{"estimate":2,"name":"Bao7Qb.test.com"},{"estimate":2,"name":".ZguNCWgzm.test.com"}],"top_qtype":[{"estimate":100,"name":"AAAA"},{"estimate":66,"name":"NS"},{"estimate":60,"name":"A"},{"estimate":60,"name":"SOA"},{"estimate":56,"name":"MX"},{"estimate":46,"name":"TXT"},{"estimate":32,"name":"CNAME"}],"top_rcode":[{"estimate":210,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"43151"},{"estimate":2,"name":"41799"},{"estimate":2,"name":"35007"},{"estimate":2,"name":"43313"},{"estimate":2,"name":"33341"},{"estimate":2,"name":"46517"},{"estimate":2,"name":"46063"},{"estimate":2,"name":"44273"},{"estimate":2,"name":"43615"},{"estimate":2,"name":"39577"}],"wire_packets":{"deep_samples":420,"ipv4":420,"ipv6":0,"noerror":0,"nxdomain":0,"queries":210,"refused":0,"replies":210,"srvfail":0,"tcp":420,"total":420,"udp":0},"xact":{"counts":{"timed_out":0,"total":210},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":210}}},"packets":{"deep_samples":2100,"in":2100,"ipv4":2100,"ipv6":0,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706433},"tcp":2100,"top_ASN":[{"estimate":2100,"name":"Unknown"}],"top_geoLoc":[{"estimate":2100,"name":"Unknown"}],"top_ipv4":[{"estimate":2100,"name":"127.0.0.1"}],"top_ipv6":[],"total":2100,"udp":0}}}
+{"5m":{"dns":{"period":{"length":7,"start_ts":1567706433},"top_nxdomain":[],"top_qname2":[{"estimate":420,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".lMw.test.com"},{"estimate":2,"name":".rZ4.test.com"},{"estimate":2,"name":"ZX0A4K.test.com"},{"estimate":2,"name":".6cR5fxGGfF.test.com"},{"estimate":2,"name":".lk06eYI2ck.test.com"},{"estimate":2,"name":".2at.test.com"},{"estimate":2,"name":".gHsieFqf.test.com"},{"estimate":2,"name":".uuteIwE.test.com"},{"estimate":2,"name":"Bao7Qb.test.com"},{"estimate":2,"name":".ZguNCWgzm.test.com"}],"top_qtype":[{"estimate":100,"name":"AAAA"},{"estimate":66,"name":"NS"},{"estimate":60,"name":"A"},{"estimate":60,"name":"SOA"},{"estimate":56,"name":"MX"},{"estimate":46,"name":"TXT"},{"estimate":32,"name":"CNAME"}],"top_rcode":[{"estimate":210,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"43151"},{"estimate":2,"name":"41799"},{"estimate":2,"name":"35007"},{"estimate":2,"name":"43313"},{"estimate":2,"name":"33341"},{"estimate":2,"name":"46517"},{"estimate":2,"name":"46063"},{"estimate":2,"name":"44273"},{"estimate":2,"name":"43615"},{"estimate":2,"name":"39577"}],"wire_packets":{"deep_samples":420,"filtered":0,"ipv4":420,"ipv6":0,"noerror":0,"nxdomain":0,"queries":210,"refused":0,"replies":210,"srvfail":0,"tcp":420,"total":420,"udp":0},"xact":{"counts":{"timed_out":0,"total":210},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":210}}},"packets":{"deep_samples":2100,"in":2100,"ipv4":2100,"ipv6":0,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706433},"tcp":2100,"top_ASN":[{"estimate":2100,"name":"Unknown"}],"top_geoLoc":[{"estimate":2100,"name":"Unknown"}],"top_ipv4":[{"estimate":2100,"name":"127.0.0.1"}],"top_ipv6":[],"total":2100,"udp":0}}}

integration_tests/output-templates/dns_ipv4_udp.Darwin.json

@@ -1 +1 @@
-{"5m":{"dns":{"period":{"length":6,"start_ts":1567706414},"top_nxdomain":[],"top_qname2":[{"estimate":140,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".yhsx.test.com"},{"estimate":2,"name":".rEdwaRK.test.com"},{"estimate":2,"name":".-cSCWAO.test.com"},{"estimate":2,"name":"ik4R35VBCx.test.com"},{"estimate":2,"name":".-q-SZlz.test.com"},{"estimate":2,"name":".1gGN.test.com"},{"estimate":2,"name":".J-r.test.com"},{"estimate":2,"name":".cx.test.com"},{"estimate":2,"name":".N5V-rUqc.test.com"},{"estimate":2,"name":".TQHgrpzDe.test.com"}],"top_qtype":[{"estimate":34,"name":"AAAA"},{"estimate":24,"name":"NS"},{"estimate":18,"name":"SOA"},{"estimate":18,"name":"TXT"},{"estimate":16,"name":"A"},{"estimate":16,"name":"CNAME"},{"estimate":14,"name":"MX"}],"top_rcode":[{"estimate":70,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":14,"name":"38352"},{"estimate":14,"name":"59755"},{"estimate":14,"name":"45478"},{"estimate":14,"name":"55945"},{"estimate":14,"name":"37253"},{"estimate":14,"name":"46297"},{"estimate":14,"name":"37371"},{"estimate":14,"name":"53819"},{"estimate":14,"name":"39485"},{"estimate":14,"name":"38302"}],"wire_packets":{"deep_samples":140,"ipv4":140,"ipv6":0,"noerror":0,"nxdomain":0,"queries":70,"refused":0,"replies":70,"srvfail":0,"tcp":0,"total":140,"udp":140},"xact":{"counts":{"timed_out":0,"total":70},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":70}}},"packets":{"deep_samples":140,"in":140,"ipv4":140,"ipv6":0,"other_l4":0,"out":0,"period":{"length":6,"start_ts":1567706414},"tcp":0,"top_ASN":[{"estimate":140,"name":"Unknown"}],"top_geoLoc":[{"estimate":140,"name":"Unknown"}],"top_ipv4":[{"estimate":140,"name":"127.0.0.1"}],"top_ipv6":[],"total":140,"udp":140}}}
+{"5m":{"dns":{"period":{"length":6,"start_ts":1567706414},"top_nxdomain":[],"top_qname2":[{"estimate":140,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".yhsx.test.com"},{"estimate":2,"name":".rEdwaRK.test.com"},{"estimate":2,"name":".-cSCWAO.test.com"},{"estimate":2,"name":"ik4R35VBCx.test.com"},{"estimate":2,"name":".-q-SZlz.test.com"},{"estimate":2,"name":".1gGN.test.com"},{"estimate":2,"name":".J-r.test.com"},{"estimate":2,"name":".cx.test.com"},{"estimate":2,"name":".N5V-rUqc.test.com"},{"estimate":2,"name":".TQHgrpzDe.test.com"}],"top_qtype":[{"estimate":34,"name":"AAAA"},{"estimate":24,"name":"NS"},{"estimate":18,"name":"SOA"},{"estimate":18,"name":"TXT"},{"estimate":16,"name":"A"},{"estimate":16,"name":"CNAME"},{"estimate":14,"name":"MX"}],"top_rcode":[{"estimate":70,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":14,"name":"38352"},{"estimate":14,"name":"59755"},{"estimate":14,"name":"45478"},{"estimate":14,"name":"55945"},{"estimate":14,"name":"37253"},{"estimate":14,"name":"46297"},{"estimate":14,"name":"37371"},{"estimate":14,"name":"53819"},{"estimate":14,"name":"39485"},{"estimate":14,"name":"38302"}],"wire_packets":{"deep_samples":140,"filtered":0,"ipv4":140,"ipv6":0,"noerror":0,"nxdomain":0,"queries":70,"refused":0,"replies":70,"srvfail":0,"tcp":0,"total":140,"udp":140},"xact":{"counts":{"timed_out":0,"total":70},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":70}}},"packets":{"deep_samples":140,"in":140,"ipv4":140,"ipv6":0,"other_l4":0,"out":0,"period":{"length":6,"start_ts":1567706414},"tcp":0,"top_ASN":[{"estimate":140,"name":"Unknown"}],"top_geoLoc":[{"estimate":140,"name":"Unknown"}],"top_ipv4":[{"estimate":140,"name":"127.0.0.1"}],"top_ipv6":[],"total":140,"udp":140}}}

integration_tests/output-templates/dns_ipv4_udp.Linux.json

@@ -1 +1 @@
-{"5m":{"dns":{"period":{"length":6,"start_ts":1567706414},"top_nxdomain":[],"top_qname2":[{"estimate":140,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".gTjGva7m-8.test.com"},{"estimate":2,"name":".pWK6.test.com"},{"estimate":2,"name":".TQHgrpzDe.test.com"},{"estimate":2,"name":".vmTwD0v30.test.com"},{"estimate":2,"name":".2MT.test.com"},{"estimate":2,"name":".GnKHW4hgN.test.com"},{"estimate":2,"name":"ik4R35VBCx.test.com"},{"estimate":2,"name":".cx.test.com"},{"estimate":2,"name":"G2s1RNfdkE.test.com"},{"estimate":2,"name":".yGa.test.com"}],"top_qtype":[{"estimate":34,"name":"AAAA"},{"estimate":24,"name":"NS"},{"estimate":18,"name":"SOA"},{"estimate":18,"name":"TXT"},{"estimate":16,"name":"A"},{"estimate":16,"name":"CNAME"},{"estimate":14,"name":"MX"}],"top_rcode":[{"estimate":70,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":14,"name":"38352"},{"estimate":14,"name":"59755"},{"estimate":14,"name":"45478"},{"estimate":14,"name":"55945"},{"estimate":14,"name":"37253"},{"estimate":14,"name":"46297"},{"estimate":14,"name":"37371"},{"estimate":14,"name":"53819"},{"estimate":14,"name":"39485"},{"estimate":14,"name":"38302"}],"wire_packets":{"deep_samples":140,"ipv4":140,"ipv6":0,"noerror":0,"nxdomain":0,"queries":70,"refused":0,"replies":70,"srvfail":0,"tcp":0,"total":140,"udp":140},"xact":{"counts":{"timed_out":0,"total":70},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":70}}},"packets":{"deep_samples":140,"in":140,"ipv4":140,"ipv6":0,"other_l4":0,"out":0,"period":{"length":6,"start_ts":1567706414},"tcp":0,"top_ASN":[{"estimate":140,"name":"Unknown"}],"top_geoLoc":[{"estimate":140,"name":"Unknown"}],"top_ipv4":[{"estimate":140,"name":"127.0.0.1"}],"top_ipv6":[],"total":140,"udp":140}}}
+{"5m":{"dns":{"period":{"length":6,"start_ts":1567706414},"top_nxdomain":[],"top_qname2":[{"estimate":140,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".gTjGva7m-8.test.com"},{"estimate":2,"name":".pWK6.test.com"},{"estimate":2,"name":".TQHgrpzDe.test.com"},{"estimate":2,"name":".vmTwD0v30.test.com"},{"estimate":2,"name":".2MT.test.com"},{"estimate":2,"name":".GnKHW4hgN.test.com"},{"estimate":2,"name":"ik4R35VBCx.test.com"},{"estimate":2,"name":".cx.test.com"},{"estimate":2,"name":"G2s1RNfdkE.test.com"},{"estimate":2,"name":".yGa.test.com"}],"top_qtype":[{"estimate":34,"name":"AAAA"},{"estimate":24,"name":"NS"},{"estimate":18,"name":"SOA"},{"estimate":18,"name":"TXT"},{"estimate":16,"name":"A"},{"estimate":16,"name":"CNAME"},{"estimate":14,"name":"MX"}],"top_rcode":[{"estimate":70,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":14,"name":"38352"},{"estimate":14,"name":"59755"},{"estimate":14,"name":"45478"},{"estimate":14,"name":"55945"},{"estimate":14,"name":"37253"},{"estimate":14,"name":"46297"},{"estimate":14,"name":"37371"},{"estimate":14,"name":"53819"},{"estimate":14,"name":"39485"},{"estimate":14,"name":"38302"}],"wire_packets":{"deep_samples":140,"filtered":0,"ipv4":140,"ipv6":0,"noerror":0,"nxdomain":0,"queries":70,"refused":0,"replies":70,"srvfail":0,"tcp":0,"total":140,"udp":140},"xact":{"counts":{"timed_out":0,"total":70},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":70}}},"packets":{"deep_samples":140,"in":140,"ipv4":140,"ipv6":0,"other_l4":0,"out":0,"period":{"length":6,"start_ts":1567706414},"tcp":0,"top_ASN":[{"estimate":140,"name":"Unknown"}],"top_geoLoc":[{"estimate":140,"name":"Unknown"}],"top_ipv4":[{"estimate":140,"name":"127.0.0.1"}],"top_ipv6":[],"total":140,"udp":140}}}

integration_tests/output-templates/dns_ipv6_tcp.Darwin.json

@@ -1 +1 @@
-{"5m":{"dns":{"period":{"length":7,"start_ts":1567706308},"top_nxdomain":[],"top_qname2":[{"estimate":360,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".8Zd.test.com"},{"estimate":2,"name":".7iF.test.com"},{"estimate":2,"name":".eXz.test.com"},{"estimate":2,"name":".j_dakR7.test.com"},{"estimate":2,"name":"2Z.test.com"},{"estimate":2,"name":".Sl1D.test.com"},{"estimate":2,"name":".V_o.test.com"},{"estimate":2,"name":".bmbEQvNBk.test.com"},{"estimate":2,"name":".DU5Q4ir-4A.test.com"},{"estimate":2,"name":".QD.test.com"}],"top_qtype":[{"estimate":94,"name":"AAAA"},{"estimate":58,"name":"CNAME"},{"estimate":48,"name":"SOA"},{"estimate":48,"name":"NS"},{"estimate":40,"name":"TXT"},{"estimate":38,"name":"MX"},{"estimate":34,"name":"A"}],"top_rcode":[{"estimate":180,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"34743"},{"estimate":2,"name":"40389"},{"estimate":2,"name":"43851"},{"estimate":2,"name":"40027"},{"estimate":2,"name":"33933"},{"estimate":2,"name":"39459"},{"estimate":2,"name":"43355"},{"estimate":2,"name":"40595"},{"estimate":2,"name":"38367"},{"estimate":2,"name":"36465"}],"wire_packets":{"deep_samples":360,"ipv4":0,"ipv6":360,"noerror":0,"nxdomain":0,"queries":180,"refused":0,"replies":180,"srvfail":0,"tcp":360,"total":360,"udp":0},"xact":{"counts":{"timed_out":0,"total":180},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":180}}},"packets":{"deep_samples":1800,"in":0,"ipv4":0,"ipv6":1800,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706308},"tcp":1800,"top_ASN":[],"top_geoLoc":[],"top_ipv4":[],"top_ipv6":[],"total":1800,"udp":0}}}
+{"5m":{"dns":{"period":{"length":7,"start_ts":1567706308},"top_nxdomain":[],"top_qname2":[{"estimate":360,"name":".test.com"}],"top_qname3":[{"estimate":2,"name":".8Zd.test.com"},{"estimate":2,"name":".7iF.test.com"},{"estimate":2,"name":".eXz.test.com"},{"estimate":2,"name":".j_dakR7.test.com"},{"estimate":2,"name":"2Z.test.com"},{"estimate":2,"name":".Sl1D.test.com"},{"estimate":2,"name":".V_o.test.com"},{"estimate":2,"name":".bmbEQvNBk.test.com"},{"estimate":2,"name":".DU5Q4ir-4A.test.com"},{"estimate":2,"name":".QD.test.com"}],"top_qtype":[{"estimate":94,"name":"AAAA"},{"estimate":58,"name":"CNAME"},{"estimate":48,"name":"SOA"},{"estimate":48,"name":"NS"},{"estimate":40,"name":"TXT"},{"estimate":38,"name":"MX"},{"estimate":34,"name":"A"}],"top_rcode":[{"estimate":180,"name":"NOTIMP"}],"top_refused":[],"top_srvfail":[],"top_udp_ports":[{"estimate":2,"name":"34743"},{"estimate":2,"name":"40389"},{"estimate":2,"name":"43851"},{"estimate":2,"name":"40027"},{"estimate":2,"name":"33933"},{"estimate":2,"name":"39459"},{"estimate":2,"name":"43355"},{"estimate":2,"name":"40595"},{"estimate":2,"name":"38367"},{"estimate":2,"name":"36465"}],"wire_packets":{"deep_samples":360,"filtered":0,"ipv4":0,"ipv6":360,"noerror":0,"nxdomain":0,"queries":180,"refused":0,"replies":180,"srvfail":0,"tcp":360,"total":360,"udp":0},"xact":{"counts":{"timed_out":0,"total":180},"in":{"top_slow":[],"total":0},"out":{"top_slow":[],"total":180}}},"packets":{"deep_samples":1800,"in":0,"ipv4":0,"ipv6":1800,"other_l4":0,"out":0,"period":{"length":7,"start_ts":1567706308},"tcp":1800,"top_ASN":[],"top_geoLoc":[],"top_ipv4":[],"top_ipv6":[],"total":1800,"udp":0}}}