2018-04-13 – dnstap fanout and replay

I have a short wishlist of dnstap-related tools. I haven’t managed to find out if anything like this already exists - if it does exist I’ll be grateful for any pointers!


We have a couple of kinds of people who have expressed interest in getting dnstap feeds from our campus resolvers (though this is not yet happening).

The dnstap implementation in BIND only supports one output stream, so if we are going to satisfy these consumers, we would need to split the dnstap feed downstream of BIND before feeding the distributaries onwards.


More recently it occurred to me that it might be useful to generate queries from a dnstap feed. I have a couple of scenarios:

I’m not really insterested in the responses to these queries so it’s OK if the replay just drops the answers. (Though when replaying a full client query feed it might be useful to compare the replay responses to the recorded feed of client responses.)


If anything like this does not exist, I might write it myself.

I have not used protobufs before so I’m keen to hear advice from those who have already got their hands dirty / fingers burned.

I’m tempted to weld libfstrm to Lua, so you can configure filtering, replication, and output with a bit of Lua. The number of Lua protobuf implementations is a bit of a worry - if anyone has a recommendation I’d like to short-cut the experimental stage. (I should ask this on the Lua list I guess!)

Alternatively it might be easier to hack around with the golang-dnstap code, tho then I would have to think harder about how to configure it…

⇐ 2018-04-09 ⇐ DNSSEC localized validation ⇐ ⇒ How to test a web server before pointing the DNS at it ⇒ 2018-05-09 ⇒