dsc has two major components (described below): Collector and Presenter. The tool uses a CGI script to display data in a web browser. The interface allows user to change time scales, to select particular nodes within a DNS server cluster, and to isolate individual dataset keys.

A detailed manual is available.

Collector

The collector process uses libpcap to recieve DNS messages sent and received on a network interface. It may run on the same machine as the DNS server, or on another system connected to a switch configured with port mirroring. A configuration file defines some number of datasets and other options. Datasets are dumped to disk every 60 seconds as XML files. A cron job copies the XML files to a separate server for archiving and further processing.

Presenter

This component receives XML datasets from collectors. Since parsing XML files is slower than we'd like, an extractor process converts them to another format. Currently that format is a line-based text file, although we may use a relational database in the future.