Description of dnstop

Dnstop is a libpcap application (like tcpdump) that displays
various tables of DNS traffic on your network.
Currently dnstop displays tables of:

* Source IP addresses
* Destination IP addresses
* Query types
* Response codes
* Opcodes
* Top level domains
* Second level domains
* Third level domains

Dnstop supports both IPv4 and IPv6 addresses.

To help find especially undesirable DNS queries, dnstop provides
a number of filters. The filters tell dnstop to display only the
following types of queries:

* For unknown or invalid TLDs
* A queries where the query name is already an IP address
* PTR queries for RFC1918 address space
* Responses with code REFUSED 

Dnstop can either read packets from the live capture device,
or from a tcpdump savefile.