subgraph "Process"
    C1["Sampling based of ratio"]
    C2["Packet Process"]
    C3["Dispatcher"]
    O11["Output1"]
    O12["Domain Skip (optional)"]
    O13["Domain Allow (optional)"]
    O21["Output2"]
    O22["Domain Skip (optional)"]
    O23["Domain Allow (optional)"]
    O31["Output3"]
    O32["Domain Skip (optional)"]
    O33["Domain Allow (optional)"]
end

B1 --> Process
B2 --> Process
B3 --> Process

C1 --> C2
C2 --> C3
C3 --> O11
C3 --> O21
C3 --> O31

O11 --> O12 --> O13
O21 --> O22 --> O23
O31 --> O32 --> O33

subgraph Output
    Splunk
    Syslog
    H["ClickHouse"]
    Postgres
    Kafka
    I["JSON File"]
    Influx
    Elastic
    J["stdout"]
    Parquet
    Sentinel
end

O13 --> H
O23 --> I
O33 --> J

# Funcionalidades principales

- Posibilidad de usar `afpacket` y captura de paquetes con zero-copy en Linux.
- Soporta BPF
- Posibilidad de enmascarar la dirección IP para mejorar la privacidad
- Posibilidad de tener una relación de muestreo de preprocesamiento
- Posibilidad de tener una lista de `fqdn` "omitir" para evitar escribir algunos dominios/sufijo/prefijo al almacenamiento
- Posibilidad de tener una lista de dominios "permitidos", utilizada para registrar el acceso a ciertos dominios
- Recarga en caliente de archivos/urls de dominios omitidos y permitidos
- Salida modular con lógica configurable por flujo de salida.
- Política automática de retención de datos usando el atributo TTL de ClickHouse
- Panel de Grafana integrado para salida de ClickHouse.
- Posibilidad de distribuirse como un único binario enlazado estáticamente
- Posibilidad de configurarse mediante variables de entorno, opciones de línea de comandos o archivo de configuración
- Posibilidad de muestrear salidas usando la capacidad SAMPLE de ClickHouse
- Posibilidad de enviar métricas usando `prometheus` y `statstd`
- Alto ratio de compresión gracias al almacenamiento LZ4 incorporado de ClickHouse
- Soporta DNS sobre TCP, DNS fragmentado (udp/tcp) e IPv6
- Soporta [dnstap](https://github.com/dnstap/golang-dnstap) sobre socket Unix o TCP
- Integración SIEM incorporada con Splunk y Microsoft Sentinel

# Instalación

## Linux

La mejor manera de empezar con `dnsmonster` es descargar el binario desde la sección de lanzamientos. El binario está construido estáticamente contra `musl`, por lo que debería funcionar sin problemas en muchas distribuciones. Para soporte de `afpacket`, debes usar un kernel 3.x+. Cualquier distribución Linux moderna (CentOS/RHEL 7+, Ubuntu 14.0.4.2+, Debian 7+) incluye una versión 3.x+, así que debería funcionar de inmediato. Si tu distribución no funciona con la versión precompilada, por favor envía un issue con los detalles y compila `dnsmonster` manualmente usando esta sección [Compilar manualmente](#build-manually).

### Contenedor

Dado que `dnsmonster` utiliza funcionalidad de captura de paquetes en bruto, el demonio Docker/Podman debe otorgar la capacidad al contenedor```
sudo docker run --rm -it --net=host --cap-add NET_RAW --cap-add NET_ADMIN --name dnsmonster ghcr.io/mosajjal/dnsmonster:latest --devName lo --stdoutOutputType=1

- sin `libpcap`:
`dnsmonster` solo usa una función de `libpcap`, y es convertir los filtros de estilo `tcpdump` en bytecode BPF. Si puedes vivir sin soporte BPF, puedes compilar `dnsmonster` sin `libpcap`. Ten en cuenta que para cualquier otra plataforma, la captura de paquetes recurre a `libpcap`, por lo que se convierte en una dependencia obligatoria (*BSD, Windows, Darwin).```sh
git clone https://github.com/mosajjal/dnsmonster --depth 1 /tmp/dnsmonster 
cd /tmp/dnsmonster
go get
go build -o dnsmonster -tags nolibpcap ./cmd/dnsmonster

Para obtener más información sobre cómo se crea el binario enlazado estáticamente, eche un vistazo al [este](https://github.com/fenkohq/dnsmonster/blob/main/Dockerfile) Dockerfile.

## Windows

La compilación en Windows es muy similar a la de Linux. Solo asegúrate de tener `npcap`. Clona el repositorio (`--history 1` funciona) y ejecuta `go get` y `go build ./cmd/dnsmonster`

Como se mencionó, la versión para Windows del binario depende de que [npcap](https://nmap.org/npcap/#download) esté instalado. Después de la instalación, el binario debería funcionar sin problemas. Ha sido probado en un entorno Windows 10 y se ejecutó sin inconvenientes. Para encontrar los nombres de las interfaces para dar el parámetro `--devName` y comenzar a capturar, deberás hacer lo siguiente:

  - abre cmd.exe como Administrador y ejecuta lo siguiente: `getmac.exe`, verás una tabla con la dirección MAC de tus interfaces y una columna Transport Name con algo como esto: `\Device\Tcpip_{16000000-0000-0000-0000-145C4638064C}`
  - ejecuta `dnsmonster.exe` en `cmd.exe` de esta manera:```sh
dnsmonster.exe --devName \Device\NPF_{16000000-0000-0000-0000-145C4638064C}

# Arquitectura

## Instalación todo en uno usando Docker

![Diagrama básico de AIO](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/dnsmonster-basic.svg)

En el diagrama de ejemplo, se captura el tráfico de entrada/salida del servidor DNS, después se añade una capa opcional de agregación de paquetes antes de llegar al servidor DNSMonster. Los datos de salida que salen de los servidores DNS son muy útiles para realizar análisis de caché y rendimiento en el conjunto de servidores DNS. Si no dispone de un agregador, puede conectar ambos TAPs directamente a DNSMonster y tener dos Agentes DNSMonster observando el tráfico.

Al ejecutar `./autobuild.sh` se crean múltiples contenedores:

* múltiples instancias de `dnsmonster` para observar el tráfico en cualquier interfaz. La lista de interfaces se solicitará como parte de `autobuild.sh`
* una instancia de `clickhouse` para recopilar la salida de `dnsmonster` y guardar todos los registros/datos en un directorio de datos y registros. Ambos se solicitarán como parte de `autobuild.sh`
* una instancia de `grafana` que observa los datos de `clickhouse` con un panel prediseñado.

### Demo todo en uno

[![Demo AIO](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/aio_demo.svg)](static/aio_demo.svg)

## Despliegue empresarial

![Diagrama básico de AIO](https://raw.githubusercontent.com/fenkohq/dnsmonster/HEAD/static/dnsmonster-enterprise.svg)

# Configuración

DNSMonster se puede configurar mediante 3 métodos diferentes. Opciones de línea de comandos, variables de entorno y archivo de configuración. Orden de precedencia:

- Opciones de línea de comandos (no distinguen entre mayúsculas y minúsculas)
- Variables de entorno (siempre en mayúsculas)
- Archivo de configuración (distingue entre mayúsculas y minúsculas, minúsculas)
- Valores predeterminados (sin configuración)

## Opciones de línea de comandos

Tenga en cuenta que los argumentos de línea de comandos no distinguen entre mayúsculas y minúsculas a partir de v0.9.5

[//]: <> (inicio de opciones de línea de comandos)```sh
# [capture]
# Device used to capture
--devname=

# Pcap filename to run
--pcapfile=

# dnstap socket path. Example: unix:///tmp/dnstap.sock, tcp://127.0.0.1:8080
--dnstapsocket=

# Port selected to filter packets
--port=53

# Capture Sampling by a:b. eg sampleRatio of 1:100 will process 1 percent of the incoming packets
--sampleratio=1:1

# Cleans up packet hash table used for deduplication
--dedupcleanupinterval=1m0s

# Set the dnstap socket permission, only applicable when unix:// is used
--dnstappermission=755

# Number of routines used to handle received packets
--packethandlercount=2

# Size of the tcp assembler
--tcpassemblychannelsize=10000

# Size of the tcp result channel
--tcpresultchannelsize=10000

# Number of routines used to handle tcp packets
--tcphandlercount=1

# Size of the channel to send packets to be defragged
--defraggerchannelsize=10000

# Size of the channel where the defragged packets are returned
--defraggerchannelreturnsize=10000

# Size of the packet handler channel
--packetchannelsize=1000

# Afpacket Buffersize in MB
--afpacketbuffersizemb=64

# BPF filter applied to the packet stream. If port is selected, the packets will not be defragged.
--filter=((ip and (ip[9] == 6 or ip[9] == 17)) or (ip6 and (ip6[6] == 17 or ip6[6] == 6 or ip6[6] == 44)))

# Use AFPacket for live captures. Supported on Linux 3.0+ only
--useafpacket

# The PCAP capture does not contain ethernet frames
--noetherframe

# Deduplicate incoming packets, Only supported with --devName and --pcapFile. Experimental 
--dedup

# Do not put the interface in promiscuous mode
--nopromiscuous

# [clickhouse_output]
# Address of the clickhouse database to save the results. multiple values can be provided.
--clickhouseaddress=localhost:9000

# Username to connect to the clickhouse database
--clickhouseusername=

# Password to connect to the clickhouse database
--clickhousepassword=

# Database to connect to the clickhouse database
--clickhousedatabase=default

# Table which data will be stored on clickhouse database
--clickhousetable=DNS_LOG

# Interval between sending results to ClickHouse. If non-0, Batch size is ignored and batch delay is used
--clickhousedelay=0s

# Clickhouse connection LZ4 compression level, 0 means no compression
--clickhousecompress=0

# Debug Clickhouse connection
--clickhousedebug

# Use TLS for Clickhouse connection
--clickhousesecure

# Save full packet query and response in JSON format.
--clickhousesavefullquery

# Use DNSTap identity field instead of ServerName for the identity field in ClickHouse
--clickhouseusednstapidentity

# What should be written to clickhouse. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--clickhouseoutputtype=0

# Minimum capacity of the cache array used to send data to clickhouse. Set close to the queries per second received to prevent allocations
--clickhousebatchsize=100000

# Number of Clickhouse output Workers
--clickhouseworkers=1

# Channel Size for each Clickhouse Worker
--clickhouseworkerchannelsize=100000

# [elastic_output]
# What should be written to elastic. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--elasticoutputtype=0

# elastic endpoint address, example: http://127.0.0.1:9200. Used if elasticOutputType is not none
--elasticoutputendpoint=

# elastic index
--elasticoutputindex=default

# Send data to Elastic in batch sizes
--elasticbatchsize=1000

# Interval between sending results to Elastic if Batch size is not filled
--elasticbatchdelay=1s

# [file_output]
# What should be written to file. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--fileoutputtype=0

# Path to output folder. Used if fileoutputType is not none
--fileoutputpath=

# Interval to rotate the file in cron format
--fileoutputrotatecron=0 0 * * *

# Number of files to keep. 0 to disable rotation
--fileoutputrotatecount=4

# Output format for file. options:json, csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
--fileoutputformat=json

# Go Template to format the output as needed
--fileoutputgotemplate={{.}}

# [influx_output]
# What should be written to influx. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--influxoutputtype=0

# influx Server address, example: http://localhost:8086. Used if influxOutputType is not none
--influxoutputserver=

# Influx Server Auth Token
--influxoutputtoken=dnsmonster

# Influx Server Bucket
--influxoutputbucket=dnsmonster

# Influx Server Org
--influxoutputorg=dnsmonster

# Minimum capacity of the cache array used to send data to Influx
--influxoutputworkers=8

# Minimum capacity of the cache array used to send data to Influx
--influxbatchsize=1000

# [kafka_output]
# What should be written to kafka. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--kafkaoutputtype=0

# kafka broker address(es), example: 127.0.0.1:9092. Used if kafkaOutputType is not none
--kafkaoutputbroker=

# Kafka topic for logging
--kafkaoutputtopic=dnsmonster

# Minimum capacity of the cache array used to send data to Kafka
--kafkabatchsize=1000

# Output format. options:json, gob. 
--kafkaoutputformat=json

# Kafka connection timeout in seconds
--kafkatimeout=3

# Interval between sending results to Kafka if Batch size is not filled
--kafkabatchdelay=1s

# Compress Kafka connection
--kafkacompress

# Compression Type Kafka connection [snappy gzip lz4 zstd]; default(snappy).
--kafkacompressiontype=snappy

# Use TLS for kafka connection
--kafkasecure

# Path of CA certificate that signs Kafka broker certificate
--kafkacacertificatepath=

# Path of TLS certificate to present to broker
--kafkatlscertificatepath=

# Path of TLS certificate key
--kafkatlskeypath=

# [parquet_output]
# What should be written to parquet file. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--parquetoutputtype=0

# Path to output folder. Used if parquetoutputtype is not none
--parquetoutputpath=

# Number of records to write to parquet file before flushing
--parquetflushbatchsize=10000

# Number of workers to write to parquet file
--parquetworkercount=4

# Size of the write buffer in bytes
--parquetwritebuffersize=256000

# [psql_output]
# What should be written to Microsoft Psql. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--psqloutputtype=0

# Psql endpoint used. must be in uri format. example: postgres://username:password@hostname:port/database?sslmode=disable
--psqlendpoint=

# Psql table which data will be stored on database
--psqltable=DNS_LOG

# Number of PSQL workers
--psqlworkers=1

# Psql Batch Size
--psqlbatchsize=1

# Interval between sending results to Psql if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--psqlbatchdelay=0s

# Timeout for any INSERT operation before we consider them failed
--psqlbatchtimeout=5s

# Save full packet query and response in JSON format.
--psqlsavefullquery

# [sentinel_output]
# What should be written to Microsoft Sentinel. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--sentineloutputtype=0

# Sentinel Shared Key, either the primary or secondary, can be found in Agents Management page under Log Analytics workspace
--sentineloutputsharedkey=

# Sentinel Customer Id. can be found in Agents Management page under Log Analytics workspace
--sentineloutputcustomerid=

# Sentinel Output LogType
--sentineloutputlogtype=dnsmonster

# Sentinel Output Proxy in URI format
--sentineloutputproxy=

# Sentinel Batch Size
--sentinelbatchsize=100

# Interval between sending results to Sentinel if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--sentinelbatchdelay=0s

# [splunk_output]
# What should be written to HEC. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--splunkoutputtype=0

# splunk endpoint address, example: http://127.0.0.1:8088. Used if splunkOutputType is not none, can be specified multiple times for load balanace and HA
--splunkoutputendpoint=

# Splunk HEC Token
--splunkoutputtoken=00000000-0000-0000-0000-000000000000

# Splunk Output Index
--splunkoutputindex=temp

# Splunk Output Proxy in URI format
--splunkoutputproxy=

# Splunk Output Source
--splunkoutputsource=dnsmonster

# Splunk Output Sourcetype
--splunkoutputsourcetype=json

# Send data to HEC in batch sizes
--splunkbatchsize=1000

# Interval between sending results to HEC if Batch size is not filled
--splunkbatchdelay=1s

# [stdout_output]
# What should be written to stdout. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--stdoutoutputtype=0

# Output format for stdout. options:json,csv, csv_no_header, gotemplate. note that the csv splits the datetime format into multiple fields
--stdoutoutputformat=json

# Go Template to format the output as needed
--stdoutoutputgotemplate={{.}}

# Number of workers
--stdoutoutputworkercount=8

# [syslog_output]
# What should be written to Syslog server. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--syslogoutputtype=0

# Syslog endpoint address, example: udp://127.0.0.1:514, tcp://127.0.0.1:514. Used if syslogOutputType is not none
--syslogoutputendpoint=udp://127.0.0.1:514

# [victoria_output]
# Victoria Output Endpoint. example: http://localhost:9428/insert/jsonline?_msg_field=rcode_id&_time_field=time
--victoriaoutputendpoint=

# What should be written to Microsoft Victoria. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--victoriaoutputtype=0

# Victoria Output Proxy in URI format
--victoriaoutputproxy=

# Number of workers
--victoriaoutputworkers=8

# Victoria Batch Size
--victoriabatchsize=100

# Interval between sending results to Victoria if Batch size is not filled. Any value larger than zero takes precedence over Batch Size
--victoriabatchdelay=0s

# [zinc_output]
# What should be written to zinc. options:
#	0: Disable Output
#	1: Enable Output without any filters
#	2: Enable Output and apply skipdomains logic
#	3: Enable Output and apply allowdomains logic
#	4: Enable Output and apply both skip and allow domains logic
--zincoutputtype=0

# index used to save data in Zinc
--zincoutputindex=dnsmonster

# zinc endpoint address, example: http://127.0.0.1:9200/api/default/_bulk. Used if zincOutputType is not none
--zincoutputendpoint=

# zinc username, example: [email protected]. Used if zincOutputType is not none
--zincoutputusername=

# zinc password, example: password. Used if zincOutputType is not none
--zincoutputpassword=

# Send data to Zinc in batch sizes
--zincbatchsize=1000

# Interval between sending results to Zinc if Batch size is not filled
--zincbatchdelay=1s

# Zing request timeout
--zinctimeout=10s

# [general]
# Garbage Collection interval for tcp assembly and ip defragmentation
--gctime=10s

# Duration to calculate interface stats
--capturestatsdelay=1s

# Mask IPv4s by bits. 32 means all the bits of IP is saved in DB
--masksize4=32

# Mask IPv6s by bits. 32 means all the bits of IP is saved in DB
--masksize6=128

# Name of the server used to index the metrics.
--servername=default

# Set debug Log format
--logformat=text

# Set debug Log level, 0:PANIC, 1:ERROR, 2:WARN, 3:INFO, 4:DEBUG
--loglevel=3

# Size of the result processor channel size
--resultchannelsize=100000

# write cpu profile to file
--cpuprofile=

# write memory profile to file
--memprofile=

# GOMAXPROCS variable
--gomaxprocs=-1

# Limit of packets logged to clickhouse every iteration. Default 0 (disabled)
--packetlimit=0

# Skip outputing domains matching items in the CSV file path. Can accept a URL (http:// or https://) or path
--skipdomainsfile=

# Hot-Reload skipdomainsfile interval
--skipdomainsrefreshinterval=1m0s

# Allow Domains logic input file. Can accept a URL (http:// or https://) or path
--allowdomainsfile=

# Hot-Reload allowdomainsfile file interval
--allowdomainsrefreshinterval=1m0s

# Skip TLS verification when making HTTPS connections
--skiptlsverification

# [metric]
# Metric Endpoint Service
--metricendpointtype=

# Statsd endpoint. Example: 127.0.0.1:8125 
--metricstatsdagent=

# Prometheus Registry endpoint. Example: http://0.0.0.0:2112/metric
--metricprometheusendpoint=

# Format for  output.
--metricformat=json

# Interval between sending results to Metric Endpoint
--metricflushinterval=10s

## Archivo de configuración
puede ejecutar `dnsmonster` usando el siguiente comando para usar el archivo de configuración:```shell
$ sudo dnsmonster --config=dnsmonster.ini

# Or you can use environment variables to set the configuration file path
$ export DNSMONSTER_CONFIG=dnsmonster.ini
$ sudo -E dnsmonster

NOTA: El comando anterior solo cambia el TTL de los datos brutos del registro DNS, que constituyen la mayor parte de su consumo de capacidad. Para asegurarse de ajustar el TTL para cada tabla de agregación, puede ejecutar lo siguiente:```sql
ALTER TABLE DNS_LOG MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_DOMAIN_COUNT` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_DOMAIN_UNIQUE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_PROTOCOL` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_GENERAL_AGGREGATIONS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_EDNS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_OPCODE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_TYPE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_CLASS` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_RESPONSECODE` MODIFY TTL DnsDate + INTERVAL 90 DAY;
ALTER TABLE `.inner.DNS_SRCIP_MASK` MODIFY TTL DnsDate + INTERVAL 90 DAY;