Open source

How the live map works

Behind the live view is dxtap: a small open-source agent (MIT) that aggregates BIND9 queries into anonymous geo cells right on the resolver. This page shows how to rebuild it on your own servers.

Source code: gitlab.noritec.de/dremaxx/dxtap — MIT licensed.

Principle

Anonymous at the source

dxtap is not in the data path. BIND delivers events via dnstap over a unix socket; the client IP is used process-locally for a GeoIP lookup and dropped immediately.

The only thing that leaves the server, once per 100 ms tick: coordinate cells rounded to 0.1° (~11 km) with a counter and the transport protocol, counters for the busiest places (city + country from the same city-level GeoIP record as the coordinates), a QTYPE histogram and the total. No IP addresses, no domain names, no ports, no per-query timestamps — the complete wire format:

1{ "type": "tick", "server": "myresolver",
2  "site": { "lat": 50.11, "lon": 8.68 },
3  "ts": 1756240000000, "n": 42,
4  "buckets": [ { "lat": 48.1, "lon": 11.6, "n": 17, "proto": "udp" } ],
5  "places": [ { "city": "Munich", "country": "DE", "n": 17 } ],
6  "qtypes": { "A": 30, "AAAA": 8, "HTTPS": 4 } }

Step 1

BIND9 with dnstap

dnstap is already compiled into the Debian/Ubuntu packages — two lines of configuration are all it takes.

Enable it in named.conf.options:

1dnstap { client query; };
2dnstap-output unix "/run/dxtap/dnstap.sock";

Check the configuration and reload — BIND connects on its own and reconnects after restarts:

1named-checkconf && rndc reconfig

Step 2

Install dxtap

A signed, public apt repository — updates arrive with apt upgrade from then on.

Add the repository and install:

1curl -fsSL https://packages.noritec.io/repository/raw/noritec-apt.asc \
2    | gpg --dearmor -o /usr/share/keyrings/noritec-apt.gpg
3echo 'deb [signed-by=/usr/share/keyrings/noritec-apt.gpg] https://packages.noritec.io/repository/apt stable main' \
4    > /etc/apt/sources.list.d/noritec.list
5apt update && apt install dxtap

GeoIP database: GeoLite2-City from MaxMind (free account) via geoipupdate — dxtap reloads the file automatically when it changes:

1apt install geoipupdate   # Edition: GeoLite2-City -> /var/lib/GeoIP/GeoLite2-City.mmdb

Configure and start — server_id, site, your backend and a token of your choosing:

1# /etc/dxtap/config.toml
2server_id = "myresolver"
3site_lat = 50.11
4site_lon = 8.68
5ingest_url = "wss://example.org/api/ingest/dxtap"
6ingest_token = "CHANGE_ME"

1systemctl start dxtap

Step 3

A backend that receives the ticks

A WebSocket server with a bearer token — that is all it takes. Minimal example with Node.js (npm install ws):

1import { WebSocketServer } from 'ws';
2
3const TOKEN = 'CHANGE_ME';
4const wss = new WebSocketServer({ port: 8080 });
5
6wss.on('connection', (socket, req) => {
7    if (req.headers.authorization !== `Bearer ${TOKEN}`) return socket.close(4401);
8    socket.on('message', (raw) => {
9        const msg = JSON.parse(String(raw));
10        if (msg.type === 'hello') console.log(`${msg.server} connected`);
11        if (msg.type === 'tick')  console.log(`${msg.server}: ${msg.n} queries, ${msg.buckets.length} cells`);
12    });
13});

From here on the data is yours: a map, a dashboard or metrics — the wire format above is the complete contract.

1{ "type": "tick", "server": "myresolver", 2 "site": { "lat": 50.11, "lon": 8.68 }, 3 "ts": 1756240000000, "n": 42, 4 "buckets": [ { "lat": 48.1, "lon": 11.6, "n": 17, "proto": "udp" } ], 5 "places": [ { "city": "Munich", "country": "DE", "n": 17 } ], 6 "qtypes": { "A": 30, "AAAA": 8, "HTTPS": 4 } }

1curl -fsSL https://packages.noritec.io/repository/raw/noritec-apt.asc \ 2 | gpg --dearmor -o /usr/share/keyrings/noritec-apt.gpg 3echo 'deb [signed-by=/usr/share/keyrings/noritec-apt.gpg] https://packages.noritec.io/repository/apt stable main' \ 4 > /etc/apt/sources.list.d/noritec.list 5apt update && apt install dxtap

1import { WebSocketServer } from 'ws'; 2 3const TOKEN = 'CHANGE_ME'; 4const wss = new WebSocketServer({ port: 8080 }); 5 6wss.on('connection', (socket, req) => { 7 if (req.headers.authorization !== `Bearer ${TOKEN}`) return socket.close(4401); 8 socket.on('message', (raw) => { 9 const msg = JSON.parse(String(raw)); 10 if (msg.type === 'hello') console.log(`${msg.server} connected`); 11 if (msg.type === 'tick') console.log(`${msg.server}: ${msg.n} queries, ${msg.buckets.length} cells`); 12 }); 13});