Comments (7)
You should rely on the caching built into the DNS system for most cases.
This would be a great way for you to get more experience with C/C++! I am happy to give you pointers. You should start by writing a stand-alone program (lookup.cpp) that takes an IP address provided on the command line and prints the hostname. Once you have that, then it is a simple matter to add the option to the tcpflow option processing system to turn of the hostname display, and then to add the display and make it the default (to match tcpdump).
Also, do you know that running reverse DNS means that people can learn that you are wiretapping them?
from tcpflow.
I'm confused. What would it do with the looked up names?
from tcpflow.
Sorry, let me clarify. Here is some example output from tcpdump:
% sudo tcpdump -i any
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
19:30:58.729513 IP dbfailover002a.c.foobar-mysql-prod.internal.48216 > gcp-ldap-ro-02.c.foobar-ldap-prod.internal.ldap: Flags [.], ack 240372327, win 350, options [nop,nop,TS val 3822553464 ecr 1203028904], length 0
19:30:58.732498 IP dbfailover002a.c.foobar-mysql-prod.internal.58008 > gcp-ldap-ro-07.c.foobar-ldap-prod.internal.ldap: Flags [.], ack 1740409873, win 350, options [nop,nop,TS val 3822553467 ecr 4263789647], length 0
19:30:58.732573 IP dbfailover002a.c.foobar-mysql-prod.internal.ssh > dleibovic.cloudvpn.foobar.com.63924: Flags [P.], seq 215632056:215632252, ack 4119599280, win 77, options [nop,nop,TS val 3822553467 ecr 59021317], length 196
19:30:58.733154 IP localhost.48372 > 127.7.7.7.domain: 60358+ PTR? 235.0.248.10.in-addr.arpa. (43)
19:30:58.733315 IP dbfailover002a.c.foobar-mysql-prod.internal.21905 > dns01.c.foobar-traffic-prod.internal.domain: 9216+ PTR? 235.0.248.10.in-addr.arpa. (43)
19:30:58.735377 IP dns01.c.foobar-traffic-prod.internal.domain > dbfailover002a.c.foobar-mysql-prod.internal.21905: 9216 1/0/0 PTR gcp-ldap-ro-02.c.foobar-ldap-prod.internal. (97)
Observe how it prints out hostnames instead of IP addresses. Whereas here is some example output from tcpflow:
% sudo tcpflow -c -i any
tcpflow: listening on any
010.248.007.223.00022-010.250.005.004.63924: <redacted>
127.000.000.001.47306-127.000.000.001.03306: <redacted>
010.248.007.223.50424-010.253.008.087.02003: <redacted>
010.248.007.223.00022-010.250.005.004.63924: <redacted>
Observe how it prints out IP addresses instead of hostnames.
What would it do with the looked up names?
I would like it to print them out in the console output.
from tcpflow.
so tcpflow
uses host IP addresses for filenames. Do you want the hostnames in the filenames?
Do you want to cache the hostname? What if you are runnon on a pcap file and the mapping of the hostname to DNS name has changed? Do you want the old mapping or the new mapping? Should it learn the DNS from DNS packets in the pcap file? What if DNS packets in the pcap file disagree with the current mapping - which should it use?
from tcpflow.
Do you want the hostnames in the filenames?
I only use tcpflow in the console print mode (-c
). Perhaps limiting the reverse DNS to console print mode would make some of these decisions easier?
Do you want to cache the hostname?
I assume that would be more performant, so probably
What if you are runnon on a pcap file and the mapping of the hostname to DNS name has changed?
Good question. I wonder what tcpdump does in this case? Does it use hostnames in the pcap file or does it only use IP addresses in the pcap file?
Anyway, I understand that there are some intricacies to work out for this feature. I apologize that I don't feel that I have the expertise to properly answer them. My personal primary use case is simply for printing out hostnames to console output.
from tcpflow.
Certainly limiting this to the -c
mode would make sense.
The DNS system already does caching. My question was whether you wanted separate caching. The issue is with fast-flux hostnames which change every few seconds.
I'm fine with this issue. Would you like to try to write it? I'm happy to give you pointers.
from tcpflow.
The DNS system already does caching. My question was whether you wanted separate caching. The issue is with fast-flux hostnames which change every few seconds.
Good point. I don't have a super strong opinion here. I wonder what the performance impact of not doing separate caching would be?
I'm fine with this issue. Would you like to try to write it? I'm happy to give you pointers.
I could try to take a stab. Caveat is that it might take me a few months to find the time. In the offhand chance that you felt the urge to implement it sooner, I wouldn't stop you. Another caveat is that I have very little experience with C / C++ :)
I'd gladly take any pointers you have though!
from tcpflow.
Related Issues (20)
- Release tag HOT 6
- Generate an error if -R option is provided without the -r option. HOT 4
- Source violates -Werror=format-security HOT 2
- tcpflow: can't parse filter expression: syntax error HOT 2
- Cannot use -S enable_report=NO in write protected directory HOT 6
- .findx file not written in real-time HOT 4
- Feature Request: need to Add Stream number HOT 6
- Lack update of read_end_offset in shift_file (tcpip.cpp)
- Is there a way to find media file's HTTP link of non web browser app? HOT 3
- Introduced change creates problem with spurious data HOT 3
- Length in IP header ignored by the code HOT 1
- upgrade to use be20_api
- Some TCP keepalives corrupt the extracted data streams HOT 4
- Remove misslead requirement for python-2.7 HOT 1
- Performance description HOT 1
- Discrepancies between TCPFlow v1.5.1 and v1.6.1 number of flows. Violations occurring with 1.6.1 but not with 1.5.1 as well. HOT 6
- Data corruption due to packets with padding (1.6.1) HOT 4
- Create new self-test with pcap.zip from #261
- Make a new release? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from tcpflow.