gamelinux/passivedns

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1734 stars · 380 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PassiveDNS is a network sniffer written in C that passively collects DNS server replies from a live interface or pcap files and logs them in a structured format. It caches and aggregates duplicate DNS answers in memory to reduce log volume while preserving DNS resolution history for security investigations.

Use cases

• log all DNS server replies on a network interface
• extract DNS records from pcap files
• investigate domain and IP resolution history during incident response
• build a passive DNS database for network security monitoring
• trace malware C2 domains back to first-seen timestamps
• support digital forensics with historical DNS answer data

When to choose

• you need historical DNS resolution data for incident handling or NSM
• you want a lightweight C-based sniffer that runs on a sensor or SPAN port
• you need to process pcap captures for DNS answers offline
• you want to deduplicate repetitive DNS answers without losing information

When to avoid

• you need active DNS queries or a recursive resolver rather than passive collection
• you want a full NSM platform with a web UI and query interface rather than a log producer
• you need Windows-native packet capture support out of the box

Facets

cli-tool · maturity maintenance

networking monitoring security logging search-engine security networking monitoring developer-tools cli cross-platform passive-dns dns-sniffer nsm digital-forensics incident-response pcap libpcap linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="gamelinux/passivedns")