Looking for a urlsnarf style dnssnarf I can daemonize. Should I give up and throw pcaps at tshark? I want to keep months of data for NSM.