Merge pull request #89 from coroot/fix_dns_capturing

fix DNS request capturing
coroot · May 28, 2024 · eae516b · eae516b
2 parents 4c8e82e + 87093a7
commit eae516b
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 11 deletions.
diff --git a/containers/container.go b/containers/container.go
@@ -582,10 +582,10 @@ func (c *Container) onDNSRequest(r *l7.RequestData) map[netaddr.IP]string {
 		dnsReq := L7Requests[l7.ProtocolDNS]
 		c.dnsStats.Requests = prometheus.NewCounterVec(
 			prometheus.CounterOpts{Name: dnsReq.Name, Help: dnsReq.Help},
-			[]string{"request_type", "status"},
+			[]string{"request_type", "domain", "status"},
 		)
 	}
-	if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, status); m != nil {
+	if m, _ := c.dnsStats.Requests.GetMetricWithLabelValues(t, fqdn, status); m != nil {
 		m.Inc()
 	}
 	if r.Duration != 0 {

diff --git a/ebpftracer/ebpf.go b/ebpftracer/ebpf.go
diff --git a/ebpftracer/ebpf/l7/dns.c b/ebpftracer/ebpf/l7/dns.c
@@ -45,7 +45,7 @@ int is_dns_response(char *buf, __u64 buf_size, __s16 *stream_id, __u32 *status)
     if (h.bits0 & DNS_OPCODE) {
        return 0;
     }
-    if (!(h.bits1 & DNS_Z)) {
+    if ((h.bits1 & DNS_Z)) {
         return 0;
     }
     h.qdcount = bpf_ntohs(h.qdcount);