mirror of
https://github.com/adulau/pdns-toolkit.git
synced 2024-12-22 16:56:05 +00:00
101 lines
2.3 KiB
Perl
101 lines
2.3 KiB
Perl
#
|
|
# Minimal and Scalable Passive DNS - Query tool
|
|
#
|
|
# Copyright (C) 2010-2012 Alexandre Dulaunoy
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
use POSIX qw(strftime);
|
|
use Redis;
|
|
use Date::Manip;
|
|
|
|
# will lookup the following RR types
|
|
my %RRTypevalue = (
|
|
"A" => 1,
|
|
"AAAA" => 28,
|
|
"CNAME" => 5,
|
|
"NS" => 2
|
|
|
|
);
|
|
|
|
my $r = Redis->new( server => '127.0.0.1:6379', encoding => undef );
|
|
|
|
|
|
while ( my ( $typename, $typevalue ) = each(%RRTypevalue) ) {
|
|
|
|
my @x = Lookup( $ARGV[0], $typevalue );
|
|
|
|
if ( defined(@x) ) {
|
|
foreach $p (@x) {
|
|
print $p. "("
|
|
. $typename . ")"
|
|
. " first seen: "
|
|
. NiceDate( FirstSeen( $ARGV[0], $p ) )
|
|
. " last seen: "
|
|
. NiceDate( LastSeen( $ARGV[0], $p ) )
|
|
. " Hits: "
|
|
. OccTuple( $ARGV[0], $p ) . "\n";
|
|
print " behind: " . join( ",", LookupIP($p) ) . "\n";
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
sub NiceDate {
|
|
my $epochvalue = shift;
|
|
|
|
return strftime( "%Y%m%d-%H:%M:%S", localtime($epochvalue) );
|
|
|
|
}
|
|
|
|
sub Lookup {
|
|
my $name = shift;
|
|
my $type = shift;
|
|
|
|
# default A record
|
|
if ( !( defined($type) ) ) { $type = 1; }
|
|
my $key = "r:$name:$type";
|
|
return $r->smembers($key);
|
|
}
|
|
|
|
sub LookupIP {
|
|
my $name = shift;
|
|
my $key = "v:$name";
|
|
return $r->smembers($key);
|
|
}
|
|
|
|
sub FirstSeen {
|
|
my $name = shift;
|
|
my $rdata = shift;
|
|
|
|
my $key = "s:$name:$rdata";
|
|
return $r->get($key);
|
|
}
|
|
|
|
sub LastSeen {
|
|
my $name = shift;
|
|
my $rdata = shift;
|
|
|
|
my $key = "l:$name:$rdata";
|
|
return $r->get($key);
|
|
}
|
|
|
|
sub OccTuple {
|
|
my $name = shift;
|
|
my $rdata = shift;
|
|
|
|
my $key = "o:$name:$rdata";
|
|
return $r->get($key);
|
|
}
|