v0.9.3

[mosajjal]

Notable Changes:

• Brand new documentation dnsmonster.dev
• Capture now accepts dash (---pcapFile=-) as a more elegant solution to pcap by stdin? #9
• Dev container populated for each commit (docker pull ghcr.io/mosajjal/dnsmonster:dev)
• Fixed a bug in dnstap pushing data to ClickHouse when the IP address is omitted
• SIGPIPE is now handled gracefully in Linux
• Major performance improvements to skipDomains and allowDomains. dnsmonster no longer uses a basic suffix and prefix string match. Instead, it uses a Ternary Search Tree to provide a much faster solution. I've tested Cisco Umbrella 1M against my test pcap as suffix matching. and there was almost no performance degredation! A small sample of the csv:

$ head top-1m-umbrella.csv
google.com.,suffix
www.google.com.,suffix
microsoft.com.,suffix
netflix.com.,suffix
data.microsoft.com.,suffix
ftl.netflix.com.,suffix
prod.ftl.netflix.com.,suffix
events.data.microsoft.com.,suffix
api-global.netflix.com.,suffix
safebrowsing.googleapis.com.,suffix

Full Changelog: v0.9.2...v0.9.3

---

This discussion was created from the release v0.9.3.