Skip to content

Instantly share code, notes, and snippets.

@korc
Created August 29, 2015 15:25
Show Gist options
  • Save korc/ee64ea827b37d6fb9fd3 to your computer and use it in GitHub Desktop.
Save korc/ee64ea827b37d6fb9fd3 to your computer and use it in GitHub Desktop.
#!/bin/sh
set -e
setname="$1"
test -n "$setname" -a -n "$2" || {
echo "Usage: ${0##*/} <setname> <pattern..>" >&2
exit 1
}
shift
: ${iface:=lo}
: ${bpf:=udp and src port 53}
: ${ws_user:=nobody}
test -n "$ws_group" -o ! -s $(which dumpcap) || ws_group="$(stat -c %G "$(which dumpcap)")"
: ${ws_group:=wireshark}
cd /
sudo -u "$ws_user" -g "$ws_group" tshark -l -i $iface -f "$bpf" -T fields -e dns.qry.name -e dns.a | while read query ips;do
echo "DNS query: '$query', returned IPs: '$ips'"
test -n "$ips" || continue
for pattern;do
case "$query" in
$pattern)
echo "Matched pattern: '$pattern', adding to '$setname'"
echo "$ips" | tr , \\n | sed -e "s/^/add $setname /" | ipset -exist restore
;;
esac
done
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment