1.0.0

This release add new features and big performance improvements

Get this version from Docker Hub: docker pull sidnlabs/entrada2:1.0.0

Improvements

• #16 Add support for Iceberg REST catalog
• #18 Add table column "dns_cnames" for CNAMES in response
• #21 Prevent writing many small Parquet files when input is many small pcap files
• #22 Added "dns_tld" column for detected tld (uses PSL)
• #23 Add option to restart file from offset after failure
• #24 Do not start processing pcap automatically after startup
• #26 Add TLD filter option, allow for dropping DNS messages
• #28 Add new column "dns_qname_full" for full qname for invalid names that cannot be parsed
• #31 Save edns0 options used by servers, new table column: "edns_server_options"

Fixes

• #29 Fix public resolver detection
• #19 Remove MinIO dependency from Docker example

Improved performance

• #20 Add new files to Iceberg table using batch
• #25 Reduce memory footprint and increase performance by reducing memory allocations
• #27 Update TLD parsing using Public Suffix List (PSL)
• #32 Improve performance historical metrics

0.0.10

Get this version from Docker Hub: docker pull sidnlabs/entrada2:0.0.10

Improvements:

• #12 pcaps generated during ddos can cause entrada to run out of memory

Fixes issues when handling DDOS traffic where the number of responses may be limited due to DNS server rate limiting (RRL)
The request/response join queue is now limited, this should prevent ENTRADA2 from running out of memory.

- #13 Performance fix for pcap processing and metrics

Improved packed processing performance

- #10 add support for new s3 object scanning

Add support for scanning for new objects on S3 when event messaging for new objects is not available on the s3 implementation.

v0.0.9

See Docker Hub