The crl_dnsstat application watches for DNS queries on UDP port 53 and counts numbers of messages and numbers of queries, aggregated by any of source IP, destination IP, opcode, query type, query class. The subjects of queries are never recorded. The example output below shows the finest aggregation (most detail) it is capable of recording; command line options can be used to reduce the detail. The "notes" column displays any unusual statisitcs: the number of messages that contained multiple queries or zero queries, and the number of messages for which the number of queries was impossible to determine.
Example output, with source IP addresses changed for privacy:
# dnsstat output version: 0.1 # begin trace interval at 965767315.016479, duration 60.000000 # DNS messages: 155056 (2584.266667/s); DNS queries: 969271 (16154.516667/s) #src dst op type class queries msgs notes 7.9.5.56 192.5.5.241 - - - 36 36 7.9.5.56 192.5.5.241 0 PTR IN 8 7.9.5.56 192.5.5.241 0 A IN 28 2.2.6.38 192.5.5.241 - - - 8 8 2.2.6.38 192.5.5.241 0 MX IN 2 2.2.6.38 192.5.5.241 0 A IN 6 2.3.6.66 192.5.5.241 - - - 183 183 2.3.6.66 192.5.5.241 0 A IN 97 2.3.6.66 192.5.5.241 0 PTR IN 86 4.8.4.12 192.5.5.241 - - - 1 1 4.8.4.12 192.5.5.241 0 A IN 1 0.4.2.12 192.5.5.241 - - - 28 28 0.4.2.12 192.5.5.241 0 PTR IN 1 0.4.2.12 192.5.5.241 0 A IN 27 2.8.8.1 192.5.5.241 - - - 16 16 2.8.8.1 192.5.5.241 0 A IN 16 8.6.3.2 192.5.5.241 - - - 511 511 8.6.3.2 192.5.5.241 0 SOA IN 2 8.6.3.2 192.5.5.241 0 ANY IN 1 8.6.3.2 192.5.5.241 0 A IN 508 . . .