DNSTOP(8)

NAME
dnstop - displays various tables of DNS traffic on your network

SYNOPSIS
dnstop [-aps] [-b expression] [-i address] [device] [savefile]

DESCRIPTION
dnstop is a small tool to listen on device or to parse the file savefile and collect and print statistics on the local network's DNS traffic. You must have read access to /dev/bpf*.

The options are as follows:

-a  anonymize addresses

-b expression
    BPF filter expression

-i address
    ignore select addresses

-p  Do not put the interface into promiscuous mode.

-s  collect second-level domain statistics

savefile
    a captured network trace in pcap format

device
    ethernet device (ie fxp0)

While running, the following options are available to alter the display:

s   display the source address table

d   display the destination address table

t   display the breakdown of query types seen

1   show the TLD table

2   show the SLD table

^R  reset the counters

^X  exit the program

?   help

AUTHORS
Duane Wessels (wessels@measurement-factory.com)

http://dnstop.measurement-factory.com/

BUGS
Unless compiled with -DUSE_PPP the program will not correctly decode PPP frames.