| adb_reportdir | /tmp/adblock-report | path for DNS related report files |
| adb_repiface | -, auto-detected | name of the reporting interface or `any` used by tcpdump |
| adb_repport | 53 | list of reporting port(s) used by tcpdump |
+| adb_repfilter | -, not set | additional tcpdump filter expression, logically ANDed to the internal reporting port filter |
| adb_repchunkcnt | 5 | report chunk count used by tcpdump |
| adb_repchunksize | 1 | report chunk size used by tcpdump in MB |
| adb_represolve | 0, disabled | resolve reporting IP addresses using reverse DNS (PTR) lookups |
**DNS reporting, enable the GeoIP Map**
adblock includes a powerful reporting tool on the DNS Report tab which shows the latest DNS statistics generated by tcpdump. To get the latest statistics always press the "Refresh" button.
+
In addition to a tabular overview adblock reporting includes a GeoIP map in a modal popup window/iframe that shows the geolocation of your own uplink addresses (in green) and the locations of blocked domains in red. To enable the GeoIP Map set the following option in "Advanced Report Settings" config tab: set `adb_map` to `1` to include the external components listed below and activate the GeoIP map.
To make this work, adblock uses the following external components:
* [CARTO basemap styles](https://github.com/CartoDB/basemap-styles) based on [OpenMapTiles](https://openmaptiles.org/schema)
* The free and quite fast [IP Geolocation API](https://ip-api.com/) to resolve the required IP/geolocation information (max. 45 blocked Domains per request)
+**DNS reporting, limit the tcpdump capture**
+`adb_repfilter` takes a regular tcpdump/BPF expression which is logically ANDed to the internal reporting port filter. It narrows the capture for every `adb_repiface` setting, not just for `any`, e.g. to skip a single noisy client or to limit the report to certain network segments.
+
+The most common use case is a capture with `adb_repiface` set to `any`, where tcpdump also picks up DNS traffic on outbound interfaces, e.g. requests that originate from the router itself and are routed through a VPN client interface. Those packets are captured correctly, but they are redundant, they clutter the report and they consume the limited pcap ring buffer configured via `adb_repchunkcnt` and `adb_repchunksize`. Some examples:
+
+| Expression | Purpose |
+| :------------------------------------------------- | :------------------------------------------------------------------ |
+| `not net 10.0.0.0/24` | skip a VPN transfer network |
+| `not (net 10.0.0.0/24 or net fd00:dead:beef::/64)` | skip a VPN transfer network, IPv4 and IPv6 |
+| `net 192.168.1.0/24 or net 192.168.2.0/24` | limit the capture to selected LAN segments |
+| `not host 192.168.1.10` | skip a single noisy client |
+| `not (host 192.168.1.10 or host 192.168.1.11)` | skip several clients |
+| `not host 9.9.9.9` | skip the forwarding between the router and its upstream resolver |
+| `ip` | capture IPv4 only |
+
+Please note:
+* the expression must not drop one direction of a DNS transaction. A report line is only emitted once the answer to a pending query has been seen, so filters like `inbound`, `src net ...` or `dst port 53` compile fine but result in an empty report
+* `net 10.0.0.1` is not a subnet, without a prefix length libpcap assumes /32 and the expression becomes equivalent to `host 10.0.0.1`
+* `not host A or not host B` does not skip both hosts, it only skips the traffic between A and B. Use `not (host A or host B)` instead
+* address, network and port primitives work with every interface, but the `vlan` and `ether` primitives require an ethernet based capture. They are rejected with `adb_repiface` set to `any` (linux cooked mode) as well as on tunnel or ppp interfaces like `wg0` or `pppoe-wan`
+* the expression can only narrow the capture, additional ports have to be added via `adb_repport`
+* a too narrow expression still compiles and tcpdump starts normally, it just yields an empty report. Keep that in mind when `adb_repiface` is changed while a filter is set, the active filter is part of the runtime status
+
**External adblock test**
In addition to the built‑in DNS reporting and GeoIP map, adblock users can verify the effectiveness of their configuration with an external test page. The [Adblock Test](https://adblock.turtlecute.org/) provides a simple way to check whether your current adblock setup is working as expected. It loads a series of test elements (ads, trackers, and other resources) and reports whether they are successfully blocked by your configuration.
adb_geourl="http://ip-api.com/json"
adb_repiface=""
adb_repport="53"
+adb_repfilter=""
adb_repchunkcnt="5"
adb_repchunksize="1"
adb_represolve="0"
filter="${filter}(udp port ${port}) or (tcp port ${port})"
done
tcpdump_filter="(${filter}) and greater 28"
+ [ -n "${adb_repfilter}" ] && tcpdump_filter="${tcpdump_filter} and (${adb_repfilter})"
if [ -n "${adb_repiface}" ] && [ -d "${adb_reportdir}" ]; then
(
"${adb_dumpcmd}" --immediate-mode -nn -p -s0 -i "${adb_repiface}" \
)
sleep 1
bg_pid="$("${adb_pgrepcmd}" -nf "${adb_reportdir}/adb_report.pcap")"
- f_log "info" "tcpdump background process started for interface: ${adb_repiface}, port: ${adb_repport}, dir: ${adb_reportdir}, pid: ${bg_pid}"
+ if [ -n "${bg_pid}" ]; then
+ f_log "info" "tcpdump background process started for interface: ${adb_repiface}, port: ${adb_repport}, filter: ${adb_repfilter:-"-"}, dir: ${adb_reportdir}, pid: ${bg_pid}"
+ else
+ f_log "info" "tcpdump background process could not be started, please check the reporting filter: ${adb_repfilter:-"-"}"
+ fi
else
f_log "info" "please set the reporting interface 'adb_repiface' and reporting directory 'adb_reportdir' manually"
fi
# build json request list
#
- search="${search//[!a-zA-Z0-9._-]/}"
+ search="${search//[!a-zA-Z0-9._:-]/}"
case "${res_count}" in
'' | *[!0-9]*)
res_count="50"
git.99rst.org / openwrt-packages.git / commitdiff