Skip to content
Inputs and filters

Inputs and filters

To get raw data into the dnsmonster pipeline you must specify an input stream. There are three supported input methods:

  • a live interface
  • a pcap file
  • a dnstap socket

Configuration for inputs and packet processing lives in the capture section of the configuration.

Input selection

FlagPurpose
--devNameEnables live capture on the device. One interface per dnsmonster instance.
--pcapFileEnables offline pcap mode. Use - to read from stdin.
--dnstapSocketEnables dnstap mode. Accepts a socket path, e.g. unix:///tmp/dnstap.sock or tcp://127.0.0.1:8080.

Capture parameters

FlagDefaultPurpose
--port53Port used to filter packets. Works independently of the BPF filter.
--sampleRatio1:1Packet sampling ratio at capture time. All packets passing the BPF are processed by default.
--dedupoffEnables the experimental de-duplication engine.
--dedupCleanupInterval60sCleans up the packet hash table used by --dedup.
--dnstapPermission755Permission on the dnstap socket. Only applies to unix://.
--filter—BPF filter applied to the packet stream.
--useAfpacketoffSwitches on the afpacket sniff method on live interfaces.
--noEtherframeoffSet when incoming packets (from a pcap file) do not contain the Ethernet frame.
--noPromiscuousoffPrevents dnsmonster from putting devName into promiscuous mode.

Worker and channel sizing

FlagDefaultPurpose
--packetHandlerCount2Workers handling received packets.
--packetChannelSize1000Size of the packet handler channel.
--tcpHandlerCount1Routines handling TCP DNS packets.
--tcpAssemblyChannelSize—Goroutine channel size for the TCP assembler, which de-fragments incoming TCP packets without slowing down normal UDP packets.
--tcpResultChannelSize10000Size of the TCP result channel.
--defraggerChannelSize10000Size of the channel carrying raw packets to be de-fragmented.
--defraggerChannelReturnSize10000Size of the channel where de-fragmented packets are sent to the output queue.
--afpacketBuffersizeMb64Afpacket buffer size in MB.

These flags are used in a variety of combinations. See filters and masks and input options for detail, and performance for how to tune them under load.