dnstrace

DnsTrace

Monitor DNS queries by host processes using eBPF!

Quick Start

Prerequisites

DnsTrace requires BCC (BPF Compiler Collection) to be installed on your system. Follow the BCC installation guide for your Linux distribution.

Installation

Install DnsTrace using pipx:

pipx install dnstrace

Usage

Run DnsTrace with root privileges:

sudo dnstrace

Command Line Options

sudo dnstrace [OPTIONS]

Options:
  -t, --tail     Stream live DNS queries (tail mode)
  -d, --domain   Show DNS query domains
  -h, --help     Show help message

Examples

Basic monitoring:

sudo dnstrace

Stream live queries:

sudo dnstrace --tail

Show domains with live-streaming:

sudo dnstrace --tail --domain

📊 Display Modes

Table Mode (Default)

• Real-time statistics dashboard
• Query type distribution charts
• Process attribution and interface details
• Responsive column layout

Tail Mode (--tail)

• Live-streaming of DNS queries
• Optional domain display with --domain flag