use-case-1.yml

# This configuration sets up DNS traffic monitoring through DNStap on port 6000
# and logging in both text and pcap formats.
#
# As prerequisites, we assume you have a DNS server which supports DNSTap (unbound, bind, powerdns, etc)
# For more informations about dnstap, read the following page: https://dmachard.github.io/posts/0001-dnstap-testing/
#

# If turned on, debug messages are printed in the standard output
global:
  trace:
    verbose: true 

pipelines:
  # Listen on tcp/6000 for incoming DNSTap protobuf messages from dns servers
  - name: tap
    dnstap:
      listen-ip: 0.0.0.0
      listen-port: 6000
    routing-policy:
      forward: [ text, pcap ]

  # Write DNS logs to log file in text format and pcap
  # with a maximum size of 100Mb for each files
  # A rotation mechanism is implemented with 10 files maximum
  # more detail about the text format: doc/configuration.md#custom-text-format
  - name: text
    logfile:
      file-path:  "/tmp/dnstap.log"
      max-size: 100
      max-files: 10
      mode: text

  - name: pcap
    logfile:
      file-path: "/tmp/dns.pcap"
      mode: pcap