eve
eve copied to clipboard
Report DNS information for flows from EVE
We've added support in the API for this (https://github.com/lf-edge/eve/blob/master/api/proto/flowlog/flowlog.proto) and need to implement the DNS side of that. See also #100
We should be able to get dnsmasq to dump this, or alternatively, scan the dnsmasq logs. One thing we'd like is the timestamp from when the (initial) DNS query was made, since that helps with correlating a DNS lookup with a TCP/UDP flow reported in the flowlog API.