t53 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 7069975db04e1afc4eaa90b4ba736d26bd1e28fd39009fe286f73318f1c502f6
+  data.tar.gz: 88edcef8e72119a0826bfa5af47feb9d84dc43e0ac1570f73e074c129832316e
+SHA512:
+  metadata.gz: 302fe63cd2f3b7d776355764964f025f47b1880786bbf90cc0d96bf027a228e2714c06fe32a0cb26d5bccf61a6710ea4283f5298384adc9ec648e61e90993836
+  data.tar.gz: 3f4225a4beeedc75821841d6f9b029258f43fbb00eb22942da5e2ce14b0b9f15e3930177cd3e681ce654b96c91b4830119854d11a2b5d65fecc1d868143ca25e

data/lib/t53.rb

@@ -0,0 +1,59 @@
+#!/usr/bin/env ruby
+
+# file: t53.rb
+
+# description: Uses the command-line tool tcpdump to monitor local 
+#              DNS requests. Publishes the requests in real-time to 
+#              a SimplePubSub broker.
+
+require "socket"
+require 'sps-pub'
+
+
+class T53
+
+  # options:
+  # nic: e.g.  eth0, enp2s0f0
+  #
+  def initialize(nic: 'eth0', sps_host: 'spsmon', sps_port: '59053', 
+                  hostname: Socket.gethostname, 
+                  topic: 'dnslookup/' + hostname, debug: false, ignorelist: [])
+
+    @nic, @host, @port, @topic, @debug = nic, sps_host, sps_port, topic, debug
+    @ignorelist = ignorelist
+    
+  end
+
+  def start()
+
+    command = "sudo tcpdump -nt -i #{@nic} udp port 53"
+    puts 'command: ' + command.inspect if @debug
+    sps = SPSPub.new host: @host, port: @port
+    ignorelist = @ignorelist
+    prev_domain = ''
+
+    IO.popen(command).each_line do |x|
+
+      puts 'x: ' + x.inspect
+
+      if x =~ /A\?/ then
+
+        match = ignorelist.find {|domain| x =~ /#{domain}/ }        
+
+        next if match 
+        domain = x[/(?<=A\?\s)[^\s]+(?=\.)/]
+        next if domain == prev_domain
+
+        sps.notice "#{@topic}: " + domain
+        prev_domain = domain
+
+        sleep 0.1
+
+      end
+
+    end
+
+  end
+
+end
+

metadata

@@ -0,0 +1,92 @@
+--- !ruby/object:Gem::Specification
+name: t53
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- James Robertson
+autorequire: 
+bindir: bin
+cert_chain:
+- |
+  -----BEGIN CERTIFICATE-----
+  MIIEXjCCAsagAwIBAgIBATANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDDCFnZW1t
+  YXN0ZXIvREM9amFtZXNyb2JlcnRzb24vREM9ZXUwHhcNMTgxMDIxMTU1NjA0WhcN
+  MTkxMDIxMTU1NjA0WjAsMSowKAYDVQQDDCFnZW1tYXN0ZXIvREM9amFtZXNyb2Jl
+  cnRzb24vREM9ZXUwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDAdFNA
+  nHva3ueBSH+MNZ5bb3MugklZ2zOkFMp6tg2FK45ecs2vTT2NfXio7w+nmbCDf34f
+  46VdizzxANrkb3WgM7rl3qi/gE9lMqyuoQULwqVcgpXpHqXPQTQSplTJL6FwspV9
+  xT254piIoa67rORK3AePT/nWmrlun5zOR40puWKUewX+Mb4oxr4l8tqmihNZAetL
+  BZTTeyzfYKnWi0zxtcMgqnu/VLqM+KFp6qrEuzv3i6L5zdiUP+fWmOUkBRjLU0j6
+  IIQOthTUR/IzckMO4IDHTQRxSTrHCdyNxziZq3V5Eu0FTzBjMrvIZu/usKcbvKCv
+  VO3R2O73q6n85Dk4s78JmKXTagJK5kxDwCApO1gw9RZ2T6YP0X4ShzGKD8CtL4NO
+  ynq/B11WvbIEJ2eL+87DdekO/PkUCqOZsJV/2sjdOpiuPUjLGnE/KNA1+iA7weHl
+  Z9dsh+DCx/dBSVJxl7q7Rv9mkL0C5TZgSvI4o+Ck+oKjiWqBqJYIhMiXJZMCAwEA
+  AaOBijCBhzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUQ5RKqUuN
+  p4oHC2+caBYmgA/1LU8wJgYDVR0RBB8wHYEbZ2VtbWFzdGVyQGphbWVzcm9iZXJ0
+  c29uLmV1MCYGA1UdEgQfMB2BG2dlbW1hc3RlckBqYW1lc3JvYmVydHNvbi5ldTAN
+  BgkqhkiG9w0BAQsFAAOCAYEAEmDFe7rd35gNqpxSLG4F55xBycv0f8R+FV7Tbp4o
+  gCmfwcKvDlYN8NTKxgZdGS9npizOrYzh3Xt1g8oTnnYALbteHO+3vPPGNXXXiq46
+  rryxL42aCJyd73iMi/RBFEZgLSnIxb+g9ylt+S6GeJ0MdDgwWwgDSuyiPoRcu/Hb
+  MpF/yi2cHL/VwYb/lhDB8HkyHQmcFdigKGVDAU5Kkp7/UFUJ0So4IaHw0CdC1OnU
+  +oXNCCtx1WtsgW9ZsVFjwHwiarxl8SVgY3YnwyeXa68d5sCCEpzRy7gmBWS/fqte
+  NI4jKfTLeejWhdNe9gpYwW+TboeiQn5Pt/DFYG4Pr3lck3qjN6B0rrgZ5ZFqmI8q
+  mbN56rzXjd/N6XIajRMVXLCEkLM24jzi69DequcRXiaDeHCq7WJMfdX+p3T7VO4Q
+  Z2qe5HUUZazh6IcJ9+sHuu5BkCQwJXG6HVZcvyrG6Dphlc+YFxu7EP+85YKHKW+v
+  JTY/G+M2ri81LCYen2nqhncW
+  -----END CERTIFICATE-----
+date: 2018-10-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: sps-pub
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.5.5
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.5.5
+description: 
+email: james@jamesrobertson.eu
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/t53.rb
+homepage: https://github.com/jrobertson/t53
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.6
+signing_key: 
+specification_version: 4
+summary: Uses the command-line tool tcpdump to monitor local DNS requests. Publishes
+  the requests in real-time to a SimplePubSub broker.
+test_files: []