v0.9.3
Notable Changes:
- Brand new documentation dnsmonster.dev
- Capture now accepts dash (
---pcapFile=-
) as a more elegant solution to #9 - Dev container populated for each commit (
docker pull ghcr.io/mosajjal/dnsmonster:dev
) - Fixed a bug in
dnstap
pushing data to ClickHouse when the IP address is omitted SIGPIPE
is now handled gracefully in Linux- Major performance improvements to
skipDomains
andallowDomains
.dnsmonster
no longer uses a basic suffix and prefix string match. Instead, it uses a Ternary Search Tree to provide a much faster solution. I've tested Cisco Umbrella 1M against my testpcap
as suffix matching. and there was almost no performance degredation! A small sample of the csv:
$ head top-1m-umbrella.csv
google.com.,suffix
www.google.com.,suffix
microsoft.com.,suffix
netflix.com.,suffix
data.microsoft.com.,suffix
ftl.netflix.com.,suffix
prod.ftl.netflix.com.,suffix
events.data.microsoft.com.,suffix
api-global.netflix.com.,suffix
safebrowsing.googleapis.com.,suffix
Full Changelog: v0.9.2...v0.9.3