Speaker
Description
Monitoring DNS software behavior (recursive or authoritative) is shifting from PCAP-style observation to more robust collection with the dnstap protocol. Consuming large volumes of dnstap data and making into something meaningful is a challenge. Vector is a tool that consumes dnstap messages and allows highly flexible receipt, manipulation, enrichment, aggregation, and re-transmission - it is the 'Swiss Army Knife' of streaming event data. This learning track will cover basic installation and configuration for a simple Vector installation attached to a recursive resolver, and will discuss in detail some of the medium-complexity tasks that can be achieved, and will briefly discuss some of the more sophisticated analysis that Quad9 has performed with Vector on their global open recursive resolvers.
