diff --git a/src/afpacket_linux.go b/src/afpacket_linux.go index e3a9ca5..5527f0f 100644 --- a/src/afpacket_linux.go +++ b/src/afpacket_linux.go @@ -39,6 +39,7 @@ func (h *afpacketHandle) SetBPFFilter(filter string, snaplen int) (err error) { } bpfIns = append(bpfIns, bpfIns2) } + log.Infof("Filter: %s", filter) if h.TPacket.SetBPF(bpfIns); err != nil { return err } @@ -91,7 +92,7 @@ func initializeLiveAFpacket(devName, filter string) *afpacketHandle { errorHandler(err) handle.SetBPFFilter(filter, 1024) - + log.Infof("Opened: %s", devName) return handle } diff --git a/src/capture_pcap.go b/src/capture_pcap.go index 8572c69..bfc6a54 100644 --- a/src/capture_pcap.go +++ b/src/capture_pcap.go @@ -17,7 +17,7 @@ var pcapStats captureStats func initializeLivePcap(devName, filter string) *pcap.Handle { // Open device - handle, err := pcap.OpenLive(devName, 65536, true, pcap.BlockForever) + handle, err := pcap.OpenLive(devName, 65536, true, time.Second*30) errorHandler(err) // Set Filter diff --git a/src/dispatch.go b/src/dispatch.go index cd5c8d8..6c99f7b 100644 --- a/src/dispatch.go +++ b/src/dispatch.go @@ -3,6 +3,8 @@ package main import ( "sync" "time" + + log "github.com/sirupsen/logrus" ) func dispatchOutput(resultChannel chan DNSResult, exiting chan bool, wg *sync.WaitGroup) { @@ -19,7 +21,10 @@ func dispatchOutput(resultChannel chan DNSResult, exiting chan bool, wg *sync.Wa allowDomainsFileTicker := time.NewTicker(generalOptions.AllowDomainsRefreshInterval) allowDomainsFileTickerChan := allowDomainsFileTicker.C if generalOptions.AllowDomainsFile == "" { + log.Infof("skipping allowDomains refresh since it's empty") allowDomainsFileTicker.Stop() + } else { + log.Infof("allowDomains refresh interval is %s", generalOptions.AllowDomainsRefreshInterval) } for { @@ -49,12 +54,14 @@ func dispatchOutput(resultChannel chan DNSResult, exiting chan bool, wg *sync.Wa case <-exiting: return case <-skipDomainsFileTickerChan: + log.Infof("reached skipDomains tick") if skipDomainMapBool { skipDomainMap = loadDomainsToMap(generalOptions.SkipDomainsFile) } else { skipDomainList = loadDomainsToList(generalOptions.SkipDomainsFile) } case <-allowDomainsFileTickerChan: + log.Infof("reached allowDomains tick") if allowDomainMapBool { allowDomainMap = loadDomainsToMap(generalOptions.AllowDomainsFile) } else { diff --git a/src/output_clickhouse.go b/src/output_clickhouse.go index 9e0e747..8d0899d 100644 --- a/src/output_clickhouse.go +++ b/src/output_clickhouse.go @@ -141,10 +141,14 @@ func clickhouseSendData(connect clickhouse.Clickhouse, batch []DNSResult, chConf } // getting variables ready - ip := batch[k].DstIP + var ip uint32 if batch[k].IPVersion == 4 { - ip = ip.Mask(net.CIDRMask(chConfig.general.maskSize, 32)) + ipTemp := batch[k].DstIP.Mask(net.CIDRMask(chConfig.general.maskSize, 32)) + ip = binary.BigEndian.Uint32(ipTemp[:4]) + } else { + ip = binary.BigEndian.Uint32(batch[k].DstIP[:4]) //ipv6 with no mask but only 32 bits } + QR := uint8(0) if batch[k].DNS.Response { QR = 1 @@ -163,7 +167,7 @@ func clickhouseSendData(connect clickhouse.Clickhouse, batch []DNSResult, chConf b.WriteDateTime(1, batch[k].Timestamp) b.WriteBytes(2, []byte(chConfig.general.serverName)) b.WriteUInt8(3, batch[k].IPVersion) - b.WriteUInt32(4, binary.BigEndian.Uint32(ip[:4])) + b.WriteUInt32(4, ip) //TODO: fix this for ipv6 b.WriteFixedString(5, []byte(batch[k].Protocol)) b.WriteUInt8(6, QR) b.WriteUInt8(7, uint8(batch[k].DNS.Opcode)) diff --git a/src/output_kafka.go b/src/output_kafka.go index f10cfea..8a3af8f 100644 --- a/src/output_kafka.go +++ b/src/output_kafka.go @@ -61,7 +61,7 @@ func kafkaOutput(kafConfig kafkaConfig) { for { select { - case data := <-resultChannel: + case data := <-kafConfig.resultChannel: if kafConfig.general.packetLimit == 0 || len(batch) < kafConfig.general.packetLimit { batch = append(batch, data) } diff --git a/src/output_splunk.go b/src/output_splunk.go index c4f35e4..6fd51a5 100644 --- a/src/output_splunk.go +++ b/src/output_splunk.go @@ -109,7 +109,7 @@ func splunkOutput(spConfig splunkConfig) { for { select { - case data := <-resultChannel: + case data := <-spConfig.resultChannel: if spConfig.general.packetLimit == 0 || len(batch) < spConfig.general.packetLimit { batch = append(batch, data) } diff --git a/src/output_stdout_file.go b/src/output_stdout_file.go index 49af291..5498ada 100644 --- a/src/output_stdout_file.go +++ b/src/output_stdout_file.go @@ -19,7 +19,7 @@ func stdoutOutput(stdConfig stdoutConfig) { for { select { - case data := <-resultChannel: + case data := <-stdConfig.resultChannel: for _, dnsQuery := range data.DNS.Question { if checkIfWeSkip(stdConfig.stdoutOutputType, dnsQuery.Name) { @@ -54,7 +54,7 @@ func fileOutput(fConfig fileConfig) { for { select { - case data := <-resultChannel: + case data := <-fConfig.resultChannel: for _, dnsQuery := range data.DNS.Question { if checkIfWeSkip(fConfig.fileOutputType, dnsQuery.Name) {