# Version 2+ - Slackspace inspection: * inside dns packet * outside dns packet - Entropy checkin on fqdn, TLD, LLD, SLD etc - detect clients that has many NXDOMAIN responces - Look at cxt when timing out that has no Client Transaction ID but a Server Transaction ID. # Version 2.0.0 == Production ready and stable == - Customizable output of fields # Version 1.5.0 == Production ready and stable == - Reads passivedns.log file on startup populating the cache with objects seen less than cache-timeout. - Support NXDOMAIN via cmdline switch. # Version 1.0.0 == Production ready and stable == - Tested/protected for: * hardening: - spoofing - poisoning - other * evation ? * flooding ? * BOF (fuzz the crap out of it) - some stats when exiting * max concurrent records cached * max concurrent sessions (cxt) * max session memory usage (cxt) * DNS counts: - how many was IPv6 - how many was IPv4 - how many was TCP - how many was UDP # Version 0.5.0 == Production ready and stable == - support specifying RR types via switch: A, AAAA, PTR, CNAME, DNAME, NAPTR, RP, SRV, TXT, SOA, MX and NS - soft memory limiting for caching of DNS objects - cmdline switch for specifying print-time - cmdline switch for specifying cache-time - cmdline for chroot - cmdline for drop privs - cmdline for specifying log file - sniff traffic from an interface - process pcap files - cmdline for specifying BPF filter - cmdline for specifying pidfile - daemon mode - output fields: timestamp||dns-client||dns-server||RR class||Query||Query Type||Answer||TTL