GitHub - tnguyenns1/pktvisor: Zero copy, authoritative DNS focused packet analysis

tnguyenns1 / pktvisor Public

forked from ns1/pktvisor-v1

Notifications You must be signed in to change notification settings
Fork 0
Star 0

Zero copy, authoritative DNS focused packet analysis

View license

0 stars 1 fork Branches Tags Activity

Star

Notifications

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 805 Commits
bpfc		bpfc
debian		debian
pktvisor		pktvisor
staging		staging
.gitignore		.gitignore
.travis.yml		.travis.yml
AUTHORS		AUTHORS
COPYING		COPYING
Cmds		Cmds
CodingStyle		CodingStyle
Extra		Extra
INSTALL		INSTALL
Makefile		Makefile
Misc		Misc
README		README
REPORTING-BUGS		REPORTING-BUGS
SubmittingPatches		SubmittingPatches
Template		Template
bpf.c		bpf.c
bpf.h		bpf.h
bpf.vim		bpf.vim
bpf_comp.c		bpf_comp.c
bpf_ext.h		bpf_ext.h
bpf_insns.h		bpf_insns.h
bpf_jit_disasm.c		bpf_jit_disasm.c
bpf_lexer.l		bpf_lexer.l
bpf_parser.y		bpf_parser.y
bpfc.8		bpfc.8
bpfc.c		bpfc.c
bpfc.zsh		bpfc.zsh
built_in.h		built_in.h
colorize.h		colorize.h
colors.h		colors.h
configure		configure
conntrack.h		conntrack.h
cookie.h		cookie.h
csum.h		csum.h
dev.c		dev.c
dev.h		dev.h
die.h		die.h
dissector.c		dissector.c
dissector.h		dissector.h
dissector_eth.c		dissector_eth.c
dissector_eth.h		dissector_eth.h
dissector_fuzz.sh		dissector_fuzz.sh
dissector_netlink.c		dissector_netlink.c
dissector_netlink.h		dissector_netlink.h
dns.c		dns.c
dns.h		dns.h
dnsctxt.c		dnsctxt.c
dnsctxt.h		dnsctxt.h
epoll2.c		epoll2.c
epoll2.h		epoll2.h
ether.conf		ether.conf
geoip.c		geoip.c
geoip.conf		geoip.conf
geoip.h		geoip.h
hash.c		hash.c
hash.h		hash.h
ioops.c		ioops.c
ioops.h		ioops.h
iosched.c		iosched.c
iosched.h		iosched.h
ipv4.h		ipv4.h
ipv6.h		ipv6.h
irq.c		irq.c
irq.h		irq.h
link.c		link.c
link.h		link.h
linktype.h		linktype.h
locking.h		locking.h
lockme.h		lockme.h
lookup.c		lookup.c
lookup.h		lookup.h
oui-update.py		oui-update.py
oui.c		oui.c
oui.conf		oui.conf
oui.h		oui.h
pcap_io.h		pcap_io.h
pcap_mm.c		pcap_mm.c
pcap_rw.c		pcap_rw.c
pcap_sg.c		pcap_sg.c
pkt_buff.h		pkt_buff.h
pktvisor.8		pktvisor.8
pktvisor.c		pktvisor.c
pktvisorui.c		pktvisorui.c
pktvisorui.h		pktvisorui.h
privs.c		privs.c
privs.h		privs.h
proc.c		proc.c
proc.h		proc.h
proto.h		proto.h
proto_arp.c		proto_arp.c
proto_dns.c		proto_dns.c
proto_ethernet.c		proto_ethernet.c
proto_gre.c		proto_gre.c
proto_icmpv4.c		proto_icmpv4.c
proto_icmpv6.c		proto_icmpv6.c
proto_igmp.c		proto_igmp.c
proto_ip_authentication_hdr.c		proto_ip_authentication_hdr.c

Repository files navigation

This project is a fork of netsniff-ng, available at http://netsniff-ng.org/

It adds a DNS protocol analyzer, which can generate various statistics about real
time traffic streams. It's intended use is to be run on authoritative DNS servers
to diagnose incoming and outgoing DNS traffic.

Like netsniff-ng, it can capture to a pcap. It also includes an ncurses based UI
that provides a top-like interface to live DNS traffic statistics, including traffic
by source/destination IP, DNS query label, result codes, source ports, Geo and ASN.