Passive DNS collection using Bro