-
Notifications
You must be signed in to change notification settings - Fork 33
Description
As a dnstap user, I want to be able to extract DNS metrics only for dnstap signals matching a specific list of IP netmasks (IPv4 and IPv6). Because dnstap is not able to use BPF filters like PCAP, the filtering must be done in user space in the dnstap module.
Therefore, dnstap input needs a new filter only_hosts (string array) which may contain hostmasks in CIDR form:
"192.168.0.0/24",
"1.2.3.4/32",
"2001:db8::/64"
dnstap input will convert these to IPv4 and IPv6 IP+netmasks and filter out any dnstap message whose query_address or response_address does not match a hostmask in the list.
This functionality is very similar to Pcap input handler's "host_spec" functionality, and that maybe used as a reference. See https://github.com/ns1labs/pktvisor/blob/7aab97ad909ef876c90b507ab13900ba4a09ebc8/src/inputs/pcap/utils.cpp#L68 and https://github.com/ns1labs/pktvisor/blob/7aab97ad909ef876c90b507ab13900ba4a09ebc8/src/inputs/pcap/PcapInputStream.cpp#L365