The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →In the current dmachard/DNS-collector project, the settings are split by job: packet capture filters belong to an input collector, DNS-aware filters and sampling belong to pipeline transformers, and local file rotation is configured in the file logger. These controls are not a single end-to-end retention or filtering policy; downstream databases, Kafka topics, and SIEMs have their own settings.
Which DNS-Collector settings handle each job?
| Goal | Configuration area | What it controls |
|---|---|---|
| Select packets or input data | Input collector | Capture source and packet-level filtering where supported, such as BPF for AF_PACKET. |
| Filter DNS records or reduce event volume | Pipeline transformer | Domain, client/server IP, response-code, general downsampling, or adaptive heavy-hitter rules. |
| Limit local log files | File logger | Rotation by file size and file count, with optional compression or a post-rotation command. |
The project uses YAML configuration, typically in config.yml, with distinct input, transformer, routing, and logger components. Its README describes collecting DNS telemetry through DNStap or live network capture, processing it, and sending it to observability, analytics, or security systems.
As an Amazon Associate I earn from qualifying purchases.
How do I filter DNS packets in DNS-Collector?
Choose the collector based on where the DNS data originates and where filtering should happen. The collector guide lists AF_PACKET with BPF support, XDP with kernel-level filtering, DNStap over TCP or UNIX sockets (including TLS-encrypted streams), and ingestion from PCAP or DNStap files. AF_PACKET is described as production ready; XDP is marked beta. Check the collector documentation for the options supported by the release you run.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A packet filter and a DNS-aware rule act at different stages. Use collector-level filtering to restrict captured packets where supported. Use the filtering transformer for rules based on decoded DNS data, such as domain names, client or server IP addresses, or response codes. The transformer guide places filtering after normalization in its documented default sequence.
#1 Best Overall
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
How does DNS-Collector sampling work?
General downsampling
The filtering transformer includes downsampling to reduce data volume by percentage. This is a broad volume-reduction rule; it is not the same as identifying a particular high-frequency query name and treating it differently. Because downsampling omits events, consider whether the resulting loss of detail is acceptable for your monitoring or investigation needs.
Adaptive heavy-hitter filtering
The separate frequency-filtering transformer tracks frequent keys and lets you choose what happens to heavy hitters. The official documentation lists these defaults: enable: false, target: "qname", threshold-heavy: 1000, action-on-heavy: "drop", sample-rate: 100, ttl: 300, and max-capacity: 500000. These are documented defaults, not performance measurements, and can be version-sensitive; verify them against the installed release before relying on them.
Rank #2
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
action-on-heavy |
Documented behavior | Data impact |
|---|---|---|
drop |
Discard heavy-hitter queries. | Those events are lost. |
sample |
Keep one in every sample-rate heavy-hitter queries. |
Most events for those keys are omitted. |
tag |
Keep queries and add frequency metadata. | Preserves events while marking frequency information. |
The documented ttl is a sliding-window half-life in seconds: counts are halved at each interval. Select the target, threshold, action, sample rate, TTL, and capacity for the traffic and analysis needs at hand rather than treating the defaults as universal recommendations.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTransformer order matters
The transformer guide says that when a custom order is configured, only transformers named in that order are initialized. An enabled transformer omitted from the custom order is ignored, so check both its settings and its place in the pipeline.
Rank #3
- SonicWall TZ270 High Availability Unit (02-SSC-6447) - Seamless Failover Protection: Designed to pair with a primary SonicWall firewall for automatic failover and continuous network uptime. Not a Standalone unit - requires an identical primary SonicWall appliance; cannot function independently.
- Defends against ransomware, malware, intrusions, and encrypted threats using Reassembly-Free Deep Packet Inspection (RFDPI), Real-Time Deep Memory Inspection (RTDMI), and Capture ATP cloud sandboxing.
- Flexible connectivity with eight Gigabit Ethernet interfaces, USB ports, and Zero-Touch deployment to simplify remote rollout and reduce IT workload.
- Built-in SD-WAN, site-to-site VPN, and TLS 1.3 decryption help optimize bandwidth, secure hybrid work, and inspect threats hidden inside encrypted traffic.
- Supports up to 750,000 concurrent connections for reliable performance and room to grow as cloud usage and devices increase.
How do I set log retention or rotation?
For local file output, the file logger documents max-size: 100 and max-files: 10 as defaults. These size and count controls govern file rotation and retention; the documentation does not establish a retention period in days. Other documented defaults are max-batch-size: 65536, flush-interval: 1, and compress: false.
Compression and post-rotation handling are separate from rotation limits. Setting compress enables gzip compression for completed files. Compression runs asynchronously, with only one compression task at a time. A postrotate-command can run a script after rotation to move or otherwise handle completed logs. These options apply to the file logger; configure retention independently in any downstream database, Kafka topic, or SIEM.
Rank #4
- NIC + Network TAP in a Single PCIe Card. Combines the functionality of a PCIe network interface controller (NIC) with an integrated network tap, delivering seamless access to 1G or 10G Ethernet links without requiring external TAP hardware.
- Dual SFP Connectors: Offers maximum flexibility with support for both copper and fiber connectivity, ensuring compatibility with diverse network setups.
- Ultra-Low Latency. Built for speed, this card ensures minimal delay, making it perfect for high-performance, latency-sensitive applications.
- Space-Efficient and Security-Optimized Design. Ideal for building network monitoring and security appliances, this card eliminates the need for an external TAP box, saving rack space and reducing costs while ensuring seamless packet capture and monitoring capabilities.
- Broad Compatibility. Compatible with Intel Ethernet Adapter drivers, enabling smooth integration across Windows, Linux, and VMware ESXi platforms.
What is a safe configuration workflow?
- Identify the source. Decide whether data arrives from live interface capture, DNStap, or stored PCAP/DNStap files; select the corresponding input collector.
- Put each filter at the right layer. Apply packet-level filtering at a supported collector, and use the
filteringtransformer for DNS-aware domain, IP, and response-code rules. - Choose the sampling behavior. Decide whether to reduce traffic generally or handle high-frequency keys through
frequency-filtering. Account for the event loss caused by dropping or sampling; tagging retains the queries. - Set local file limits. Choose
max-sizeandmax-filesto suit local disk constraints, then add compression or a post-rotation script only if it fits the archive workflow. - Validate before rollout. Run
./dnscollector -config config.yml -test-config. The configuration guide also documents SIGHUP reload behavior. Match keys and defaults to the installed release rather than assuming the movingmaindocumentation matches it.
These settings refer to the current Go-based dmachard/DNS-collector project. A separate, older CZ.NIC project with a similar name uses different configuration and is not the source for these YAML settings.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Best Value
- SECURE UPGRADE PLUS PROGRAM (3-Yr, Advanced Edition): SonicWall upgrade path that bundles a new TZ280 appliance with the Advanced Protection Suite (APSS). REQUIREMENTS: for customers upgrading from an existing SonicWall firewall; a qualifying prior unit may be required at registration. Includes 1 year of Cloud Secure Edge (CSE) Zero-Trust Network Access.
- SERVICE BUNDLE – ADVANCED PROTECTION SUITE (APSS): all Essential services plus Capture ATP cloud sandboxing with patented RTDMI, advanced DNS security, cloud Network Security Manager (NSM) management, reporting & analytics, and 24/7 support — SonicWall's recommended all-in security suite.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
