dnstap: High speed DNS logging without packet capture

2,086 views · Published 14 February 2014 · 32:56 · Indexed 29 September 2026

Channel: NANOG · 2014 · Science & Technology

Watch on YouTube

Speaker:
Robert Edmonds, Farsight Security, Inc.

The DNS protocol presents interesting logging challenges. Common approaches to DNS logging include instrumentation internal to the DNS server which generates textual log messages ("query logs"), and external passive observation of DNS network traffic ("packet capture"). This presentation will outline some of the strengths and weaknesses of these two approaches and will showcase a hybrid vendor-neutral logging implementation, "dnstap", that can provide at high speed the high quality data needed for DNS monitoring applications such as passive DNS replication and query logging.

More from this channel

• 59:03 Through a PRISM, Darkly

  NANOG

  2,106 views · 8 October 2013

• 37:19 12 Mbps @ 36,000 ft. Coming attractions in in-flight broadband

  NANOG

  598 views · 8 October 2013

• 23:25 Understanding User Experience on Mobile Devices with the ICSI Netalyzr

  NANOG

  1,167 views · 6 October 2014

• 50:17 NANOG Community Meeting

  NANOG

  44 views · 7 October 2014

• 45:30 Internet Multicast: It's Still a Thing

  NANOG

  2,043 views · 9 October 2014

• 1:17:57 ARIN Public Policy Consultation Track

  NANOG

  54 views · 4 February 2015

• 28:34 Migrating AmLight from legacy to SDN: Challenges, Results and Next Steps

  NANOG

  891 views · 5 February 2015

• 32:19 Source Routing 2.0. Why Now, Why Again?

  NANOG

  4,047 views · 5 June 2015