Passive DNS Collection & Analysis: dnstap Transaction Flows
Internet pioneer Paul Vixie introduces dnstap, a high-speed standard interface for capturing and analyzing real-time recursive DNS transaction flows.
Summary
The Critical Role of DNS in Threat Telemetry
Domain Name System (DNS) traffic contains vital telemetry for detecting malware command-and-control infrastructure, phishing domains, and data exfiltration channels.
Introducing the dnstap Protocol Interface
Paul Vixie presents dnstap, a structured, event-driven logging mechanism that captures real-time DNS queries and responses directly from recursive resolver memory.
Comparing Packet Sniffing vs. Native Resolver Logging
Vixie explains why traditional PCAP sniffing drops packets under high loads, whereas dnstap leverages framed protobuf streams for zero-loss collection.
Architecting Large-Scale Passive DNS Analytics
The presentation reviews integrating dnstap streams into security operations centers (SOCs) and passive DNS databases for global threat intelligence.
Related talks
Wild West Hackin' Fest·59 min
Security researchers examine technical aspects of Passive DNS Collection and Analysis -- the ‘dnstap’ (& fstrm) Approach.
Blacks in Cybersecurity Village·37 min
Malachi Walker
Introduces Domain Intelligence Analysis, leveraging proactive DNS artifacts and registration telemetry to detect adversary infrastructure before public IOC disclosures.
Black Hat·58 min
Presenters detail vulnerability discovery and exploitation in Multivariate Solutions To Emerging Passive DNS Challenges.