You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Alexandre Dulaunoy 235914fcf1
chg: [doc] Python 3.8 min
11 months ago
bin fix: [pdns-cof-server] use f string format instead of format() 11 months ago
etc new: [db] kvrocks support added instead of redis back-end 11 months ago
LICENSE chg: [doc] Basic README added 4 years ago chg: [doc] Python 3.8 min 11 months ago
_config.yml Set theme jekyll-theme-cayman 11 months ago create db directory and correct path 3 years ago new: [db] kvrocks support added instead of redis back-end 11 months ago new: [db] kvrocks support added instead of redis back-end 11 months ago
requirements new: [pdns-import-cof] New importer for the Passive DNS backend. 11 months ago


analyzer-d4-passivedns is an analyzer for a D4 network sensor including a complete Passive DNS server. The analyser can process data produced by D4 sensors (in passivedns CSV format (more to come)) or independently from D4 using COF websocket streams.

The package include a Passive DNS server which can be queried later to search for the Passive DNS records.




  • Python 3.8
  • Redis >5.0 or kvrocks
  • Tornado
  • iptools




All the Python 3 code will be installed in a virtualenv (PDNSENV).



All the Python 3 code will be installed in a virtualenv (PDNSENV).


Start the redis server or kvrocks server

Don't forget to set the DB directory in the redis.conf configuration. By default, the redis for Passive DNS is running on TCP port 6400

./redis/src/redis-server ./etc/redis.conf


./kvrocks/src/kvrocks -c ./etc/kvrocks.conf

Start the Passive DNS COF server

. ./PDNSENV/bin/activate
cd ./bin/
python3 ./

Feeding the Passive DNS server

You have two ways to feed the Passive DNS server. You can combine multiple streams. A sample public COF stream is available from CIRCL with the newly seen IPv6 addresses and DNS records.

(via COF websocket stream) start the importer

python3 --websocket ws://

(via D4) Configure and start the D4 analyzer

cd ./etc
cp analyzer.conf.sample analyzer.conf

Edit the analyzer.conf to match the UUID of the analyzer queue from your D4 server.

my-uuid = 6072e072-bfaa-4395-9bb1-cdb3b470d715
d4-server =
logging-level = INFO

then you can start the analyzer which will fetch the data from the analyzer, parse it and populate the Passive DNS database.

. ./PDNSENV/bin/activate/
cd ./bin/


Querying the server

adulau@kolmogorov ~/git/analyzer-d4-passivedns (master)$ curl -s | jq .
  "time_first": 1657878272,
  "time_last": 1657878272,
  "count": 1,
  "rrtype": "AAAA",
  "rrname": "",
  "rdata": "2a02:250:0:8::53",
  "origin": "origin not configured"
curl -s 
{"time_first": 1657878141, "time_last": 1657878141, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878929, "time_last": 1657878929, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878272, "time_last": 1657878272, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878189, "time_last": 1657878189, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878986, "time_last": 1657878986, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874940, "time_last": 1657874940, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874205, "time_last": 1657874205, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878165, "time_last": 1657878165, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878678, "time_last": 1657878678, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874288, "time_last": 1657874288, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878943, "time_last": 1657878943, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878141, "time_last": 1657878141, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878997, "time_last": 1657878997, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657879064, "time_last": 1657879064, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657874285, "time_last": 1657874285, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}
{"time_first": 1657878774, "time_last": 1657878774, "count": 1, "rrtype": "AAAA", "rrname": "", "rdata": "2a02:250:0:8::53", "origin": "origin not configured"}


The software is free software/open source released under the GNU Affero General Public License version 3.