
# local_address
#
#	specifies a local IP address.  used to determine the
#	"direction" of an IP packet: sending or receiving or other.
#	Repeat any number of times for all local addresses.
#
local_address 127.0.0.1;
local_address ::1;

# run_dir
#
#	dsc passes this directory to chdir() after starting.
#
run_dir "/usr/local/dsc/var/run";

# pid_file
#
#	filename where DSC should store its process-id
#
pid_file "/var/run/dsc.pid";

# bpf_program
#
#	a berkely packet filter program.  it can be used to limit
#	the number and type of queries that the application receives
#	from the kernel.  note if you limit it to "udp port 53" the
#	IP-based collectors do not work
#
#	NOTE: bpf_program must GO BEFORE interface
#
# use this to see only DNS messages
#bpf_program "udp port 53";
#
# use this to see only DNS *queries*
#bpf_program "udp dst port 53 and udp[10:2] & 0x8000 = 0";

# interface
#
# 	specifies a network interface to sniff packets from.
#	can specify more than one.
#
interface fxp0;

# qname_filter
#
#	Defines a custom QNAME-based filter for DNS messages.  If
#	you refer to this named filter on a dataset line, then only
#	queries or replies for matching QNAMEs will be counted.
#	The QNAME argument is a regular expression.  For example:
#
#	qname_filter WWW-Only ^www\. ;
#	dataset qtype dns All:null Qtype:qtype queries-only,WWW-Only ;


#
# datasets
#
#	please see the DSC manual for more information.
dataset qtype dns All:null Qtype:qtype queries-only;
dataset rcode dns All:null Rcode:rcode replies-only;
dataset opcode dns All:null Opcode:opcode queries-only;
dataset rcode_vs_replylen dns Rcode:rcode ReplyLen:msglen replies-only;
dataset client_subnet dns All:null ClientSubnet:cip4_net queries-only max-cells=200;
dataset qtype_vs_qnamelen dns Qtype:qtype QnameLen:qnamelen queries-only;
dataset qtype_vs_tld dns Qtype:qtype TLD:tld queries-only,popular-qtypes max-cells=200;
dataset certain_qnames_vs_qtype dns CertainQnames:certain_qnames Qtype:qtype queries-only;
dataset client_subnet2 dns Class:query_classification ClientSubnet:cip4_net queries-only max-cells=200;
dataset client_addr_vs_rcode dns Rcode:rcode ClientAddr:client replies-only max-cells=50;
dataset chaos_types_and_names dns Qtype:qtype Qname:qname chaos-class,queries-only;
dataset idn_qname dns All:null IDNQname:idn_qname queries-only;
dataset edns_version dns All:null EDNSVersion:edns_version queries-only;
dataset do_bit dns All:null D0:do_bit queries-only;
dataset rd_bit dns All:null RD:rd_bit queries-only;
dataset idn_vs_tld dns All:null TLD:tld queries-only,idn-only;
dataset ipv6_rsn_abusers dns All:null ClientAddr:client queries-only,aaaa-or-a6-only,root-servers-net-only max-cells=50;
dataset transport_vs_qtype dns Transport:transport Qtype:qtype queries-only;

dataset direction_vs_ipproto ip Direction:ip_direction IPProto:ip_proto any;


# bpf_vlan_tag_byte_order
#
#	Set this to 'host' on FreeBSD-4 where the VLAN id that we
#	get from BPF appears to already be in host byte order.
#bpf_vlan_tag_byte_order host;

# match_vlan
#
#	A whitespace-separated list of VLAN IDs.  If set, only the
#	packets with these VLAN IDs will be analyzed by DSC.
#
#match_vlan 100 200;
