Evidence collection
v20240219-evidences-161.json fab46c8e
Collected 1 year ago
DNS Shotgun v20240219
Incompatible changes
- CMake is now being used to build dnssim instead of Autotools
- GnuTLS 3.7.5+ is now required
Improvements
- pcap/extract-clients: always reset UDP port numbers to 53 (!56)
- pcap/extract-clients: ability to write to stdout (!62)
- pcap/filter-dnsq: skip 'special' queries for *.dotnxdomain.net (!58)
- pcap/split-clients: new tool to split larger PCAPs into smaller ones (!61)
- pcap/merge-chunks: allow disabling randomization (!67)
- tools/plot-latency: ability to diversify lines with linestyles (!69)
- tools/plot-response-rate: estimate worst-case drop caused by discarded packets (!74)
- tools/plot-packet-rate: handle incomplete last sampling period (!71)
- tools/plot-response-rate: ability to ignore RCODEs with small response rate (!73)
- pcap/filter-dnsq: ability to log malformed queries (!72)
- pcap/generate-const-qps: new tool to generate constant QPS (!33)
- tools: allow customizing plot charts with
SHOTGUN_MPLSTYLES
(!65) - replay:
--preload
argument, mainly for dnssim debugging with sanitizers (!76) - tools/plot-latency: use fractional values for humans in charts (!78)
- pcap/extract-clients: warn if some input packets were skipped (!80)
- dnssim: replace Autotools with CMake (!77, !86)
- configs: DoH configs with exclusively GET/POST methods (!82)
- tools/plot-response-rate: avoid division by zero (!89)
- tools/plot-latency: denser labels to improve logarithmic scale readability (!90)
- pcap/extract-clients: allow query rewriting - anonymization (!91)
- Support for DNS-over-QUIC
🎉 (!75)
Bugfixes
- tools/plot-response-rate: avoid white lines on white background (!55)
- tools/plot-client-distribution: properly handle file limit (!59)
- pcap: proper PCAP write error handling (!60)
- tools/plot-connections: set axis limits properly (!66)
- tools/plot-packet-rate: trim chart whitespace (!79)
- replay: do not exit silently when dnssim returns non-zero (!87)
Evidence collection
v20210714-evidences-62.json f6327c56
Collected 3 years ago
DNS Shotgun v20210714
Incompatible changes
- dnsjit 1.2.0+ is now required
- dnssim component was moved from dnsjit to this repository and has to be compiled separately (!52)
Improvements
- replay: new option
stop_after_s
added to input (!40) - tools/plot-packat-rate: new tool to plot packet rate in PCAPs (!46)
- replay/shotgun: support reading PCAP from stdin (!36)
- pcap/merge-chunks: utility to merge chunks on-the-fly (!37)
- tools/plot-response-rate: add
--rcodes-above-pct
option (!43) - tools/plot-response-rate: add
--skip-total
option (!47) - tools/plot-response-rate: add
--sum-rcodes
option (!47) - tools/plot-latency: add
--group
option to plot aggregate data (!53) - pcap/cut-pcap: new script to effetively trim a sorted PCAP (!50)
- configs: plot response rate chart with non-zero rcodes by default (!44)
- pcap/extract-clients: add --seed option for deterministic splitting (!34)
- pcap/filter-dnsq: improved malformed packet handling (!31)
- pcap/extract-clients: detect non-monotonic timestamps (!31)
- replay/shotgun: use faster mmpcap (!36)
- tools/plot-response-rate: add markers for plotting rcodes (!41)
- tools/plot-response-rate: improve color selection (!41, !42)
Bugfixes
Evidence collection
v20210203-evidences-40.json 4fd0c76a
Collected 4 years ago
2021-02-03
- new user interface
- replay.py is now the main tool instead of shotgun.lua
- new configuration format to support complex scenarios
- mixed-protocol traffic replay is supported
- some scripts in
tools/
were renamed
- fast scripts for processing PCAP data
- can be found in
pcap/
- these replaced the now removed pellet.py and scale.py
- can be found in
- added IPv4 support
- DoH is now fully supported
- comprehensive usage documentation is available at https://dns-shotgun.readthedocs.io
- minimum required dnsjit version is 1.1.0
2020-09-14
- fully supported UDP, TCP and DNS-over-TLS with dnsjit 1.0.0
- fully supported DNS-over-HTTPS with development version of dnsjit
- traffic can be replayed only over IPv6
- user interface
- may be unstable
- only very basic UI available
- more complex scenarios are no supported yet (e.g. simultaneously using multiple protocols)
- pellet.py is functional, but it is very slow and requires python-dpkt from master