Skip to content

Filter out useless PTRs by default#3039

Merged
TheTechromancer merged 3 commits into
3.0from
filter-ptrs
Apr 14, 2026
Merged

Filter out useless PTRs by default#3039
TheTechromancer merged 3 commits into
3.0from
filter-ptrs

Conversation

@TheTechromancer

@TheTechromancer TheTechromancer commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Wire up the existing (but dead) dns.filter_ptrs config option to prevent PTR-derived hostnames from being promoted to in-scope
  • When scanning IP ranges (e.g. 1.2.3.0/24), rDNS results like 1-2-3-4.ptr.randomothercorp.com now stay as affiliates (scope_distance=1) instead of being treated as fully in-scope, preventing subdomain enumeration modules from blowing up against every unrelated PTR parent domain
  • PTR-derived events are tagged with ptr for easy identification
  • Behavior can be disabled with dns.filter_ptrs: false to restore the old behavior

@TheTechromancer TheTechromancer self-assigned this Apr 14, 2026
@github-actions

github-actions Bot commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

📊 Performance Benchmark Report

Comparing 3.0 (baseline) vs filter-ptrs (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 4.19ms 4.19ms +0.0%
Bloom Filter Large Scale Dns Brute Force 17.31ms 17.68ms +2.1%
Large Closest Match Lookup 358.09ms 341.37ms -4.7%
Realistic Closest Match Workload 189.21ms 190.86ms +0.9%
Event Memory Medium Scan 1782 B/event 1777 B/event -0.3%
Event Memory Large Scan 1768 B/event 1768 B/event +0.0%
Event Validation Full Scan Startup Small Batch 411.27ms 420.57ms +2.3%
Event Validation Full Scan Startup Large Batch 569.80ms 580.47ms +1.9%
Make Event Autodetection Small 30.77ms 30.70ms -0.2%
Make Event Autodetection Large 314.07ms 311.50ms -0.8%
Make Event Explicit Types 13.74ms 13.69ms -0.4%
Excavate Single Thread Small 3.944s 3.982s +1.0%
Excavate Single Thread Large 9.740s 9.447s -3.0%
Excavate Parallel Tasks Small 4.142s 4.130s -0.3%
Excavate Parallel Tasks Large 7.230s 7.228s -0.0%
Is Ip Performance 3.13ms 3.14ms +0.2%
Make Ip Type Performance 11.38ms 11.42ms +0.3%
Mixed Ip Operations 4.48ms 4.49ms +0.2%
Memory Use Web Crawl 50.2 MB 47.4 MB -5.5%
Memory Use Subdomain Enum 19.3 MB 19.3 MB +0.0%
Scan Throughput 100 8.455s 7.891s -6.7%
Scan Throughput 1000 42.815s 41.032s -4.2%
Typical Queue Shuffle 66.03µs 65.54µs -0.7%
Priority Queue Shuffle 746.62µs 728.04µs -2.5%

🎯 Performance Summary

No significant performance changes detected (all changes <10%)


🐍 Python Version 3.11.15

@codecov

codecov Bot commented Apr 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91%. Comparing base (677f7c0) to head (8ea7d66).
⚠️ Report is 18 commits behind head on 3.0.

Additional details and impacted files
@@          Coverage Diff           @@
##             3.0   #3039    +/-   ##
======================================
- Coverage     91%     91%    -0%     
======================================
  Files        440     440            
  Lines      37550   37697   +147     
======================================
+ Hits       33987   34112   +125     
- Misses      3563    3585    +22     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@TheTechromancer TheTechromancer merged commit e10a161 into 3.0 Apr 14, 2026
18 checks passed
@liquidsec liquidsec mentioned this pull request Jun 9, 2026
@ausmaster ausmaster deleted the filter-ptrs branch June 11, 2026 01:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants