eve icon indicating copy to clipboard operation
eve copied to clipboard

Report DNS information for flows from EVE

Open eriknordmark opened this issue 6 years ago • 0 comments

We've added support in the API for this (https://github.com/lf-edge/eve/blob/master/api/proto/flowlog/flowlog.proto) and need to implement the DNS side of that. See also #100

We should be able to get dnsmasq to dump this, or alternatively, scan the dnsmasq logs. One thing we'd like is the timestamp from when the (initial) DNS query was made, since that helps with correlating a DNS lookup with a TCP/UDP flow reported in the flowlog API.

eriknordmark avatar Jun 20 '19 15:06 eriknordmark