dnsmonster
A high-performance passive DNS monitoring framework that captures, indexes, and analyzes DNS traffic for security and network insights.
What is dnsmonster?
dnsmonster is a passive DNS monitoring framework that captures and indexes DNS traffic from network interfaces, pcap files, or dnstap sockets. It helps security and network teams analyze DNS queries for threat detection, performance issues, and traffic trends, with features like IP masking to protect user privacy.
Security analysts, network administrators, and DevOps engineers who need to monitor DNS traffic at scale for threat detection, compliance, or performance optimization in enterprise environments.
Developers choose dnsmonster for its high performance (200k+ queries/second), privacy-aware design with IP masking, and extensive output flexibility—integrating seamlessly with tools like ClickHouse, Splunk, and Elasticsearch without complex dependencies.
Overview
Passive DNS Capture and Monitoring Toolkit
Use Cases
Best For
- Monitoring DNS traffic for security threats and malicious domain activity
- Analyzing DNS performance and cache efficiency in large networks
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
