Add: dns leak detection

docs/COMMANDS.md

@@ -0,0 +1,69 @@
+# WTFnet Commands
+
+This document lists CLI commands and supported flags. Output defaults to text; use `--json` for structured output.
+
+## Global flags
+- `--json` / `--pretty`
+- `--no-color` / `--quiet`
+- `-v` / `-vv` / `--verbose`
+- `--log-level <error|warn|info|debug|trace>`
+- `--log-format <text|json>`
+- `--log-file <path>`
+- `NETTOOL_LOG_FILTER` or `RUST_LOG` can override log filters (ex: `maxminddb::decoder=debug`)
+
+## sys
+- `sys ifaces`
+- `sys ip` flags: `--all`, `--iface <name>`
+- `sys route` flags: `--ipv4`, `--ipv6`, `--to <ip>`
+- `sys dns`
+
+## ports
+- `ports listen` flags: `--tcp`, `--udp`, `--port <n>`
+- `ports who <port>`
+- `ports conns` flags: `--top <n>`, `--by-process`
+
+## neigh
+- `neigh list` flags: `--ipv4`, `--ipv6`, `--iface <name>`
+
+## cert
+- `cert roots`
+- `cert baseline <path>`
+- `cert diff <path>`
+
+## geoip
+- `geoip lookup <ip>`
+- `geoip status`
+
+## probe
+- `probe ping <host>` flags: `--count <n>`, `--timeout-ms <n>`, `--interval-ms <n>`, `--no-geoip`
+- `probe tcping <host:port>` flags: `--count <n>`, `--timeout-ms <n>`, `--socks5 <url>`, `--prefer-ipv4`, `--no-geoip`
+- `probe trace <host>` flags: `--max-hops <n>`, `--per-hop <n>`, `--timeout-ms <n>`, `--udp`, `--port <n>`, `--rdns`, `--no-geoip`
+
+## dns
+- `dns query <domain> <type>` flags: `--server <ip[:port]>`, `--transport <udp|tcp|dot|doh>`, `--tls-name <name>`, `--socks5 <url>`, `--prefer-ipv4`, `--timeout-ms <n>`
+- `dns detect <domain>` flags: `--servers <csv>`, `--transport <udp|tcp|dot|doh>`, `--tls-name <name>`, `--socks5 <url>`, `--prefer-ipv4`, `--repeat <n>`, `--timeout-ms <n>`
+- `dns watch` flags: `--duration <Ns|Nms>`, `--iface <name>`, `--filter <pattern>`
+- `dns leak status` flags: `--profile <full-tunnel|proxy-stub|split>`, `--policy <path>`
+- `dns leak watch` flags: `--duration <Ns|Nms>`, `--iface <name>`, `--profile <full-tunnel|proxy-stub|split>`, `--policy <path>`, `--privacy <full|redacted|minimal>`, `--out <path>`, `--summary-only`, `--iface-diag`
+- `dns leak report` flags: `<path>`, `--privacy <full|redacted|minimal>`
+
+## http
+- `http head|get <url>` flags: `--timeout-ms <n>`, `--follow-redirects <n>`, `--show-headers`, `--show-body`, `--max-body-bytes <n>`, `--http1-only`, `--http2-only`, `--http3` (feature `http3`), `--http3-only` (feature `http3`), `--geoip`, `--socks5 <url>`
+
+## tls
+- `tls handshake|cert|verify|alpn <host:port>` flags: `--sni <name>`, `--alpn <csv>`, `--timeout-ms <n>`, `--insecure`, `--socks5 <url>`, `--prefer-ipv4`, `--show-extensions`, `--ocsp`
+
+## discover
+- `discover mdns` flags: `--duration <Ns|Nms>`, `--service <type>`
+- `discover ssdp` flags: `--duration <Ns|Nms>`
+- `discover llmnr` flags: `--duration <Ns|Nms>`, `--name <host>`
+- `discover nbns` flags: `--duration <Ns|Nms>`
+
+## diag
+- `diag` flags: `--out <path>`, `--bundle <path>`, `--dns-detect <domain>`, `--dns-timeout-ms <n>`, `--dns-repeat <n>`
+
+## calc
+- `calc subnet <cidr>|<ip> <mask>`
+- `calc contains <a> <b>`
+- `calc overlap <a> <b>`
+- `calc summarize <cidr...>`