Collectors

Collectors are responsible for gathering DNS data from different sources. They act as the input layer of your DNS-collector monitoring pipeline.

For a detailed explanation of how these components are configured and chained together, see Pipeline Routing.

Collector Categories

High-performance live traffic capture directly from network interfaces.

Collector	Status	Capabilities
AF_PACKET Sniffer	Production ready	• Live packet capture using AF_PACKET sockets • Zero-copy ring buffers • BPF (Berkeley Packet Filter) support
XDP Sniffer	Experimental	• High-performance live packet capture using eBPF/XDP (eXpress Data Path) • Kernel-level packet filtering • Minimum CPU overhead

Integration with DNS servers using network-based streaming protocols.

Collector	Status	Capabilities
DNStap Server	Production ready	• Collects DNStap streams over TCP or UNIX sockets • Full integration with BIND, Unbound, PowerDNS, etc. • Support for TLS encrypted streams
PowerDNS	Production ready	• Direct integration with PowerDNS Authoritative and Recursor • Support for Protobuf and DNStap streams
TZSP	Beta support	• Captures TZSP (Tazmen Sniffer Protocol) encapsulation streams

Parsing and ingestion of logs or stored captures from files.

Collector	Status	Capabilities
File Ingestor	Production ready	• Processes stored PCAP files • Processes stored DNStap files • Ideal for post-event forensics or batch ingestion
Tail	Production ready	• Monitors and tails plain text log files in real-time • Supports Regex pattern matching and parsing

Advanced Collectors for specific routing, filtering, or automation tasks.

Collector	Status	Capabilities
DNS Message	Production ready	• Filters and matches specific DNS messages from pipelines
HTTP Webhook	Experimental	• Receives DNS event details or payloads via HTTP Webhooks