ngrep

ngrep copied to clipboard

Hello,

I am using ngrep on FreeBSD and I cannot see how to enable reverse resolution of the IPs in the first line of the output ...

All of my output is IP only with no DNS names ... I only see a hostname if I dig deeper into the packet and look at HTTP requests (or something like that).

How can I enable reverse lookups of the IP traffic ?

Thank you.

Hi there,

Unfortunately, this is by design. The logic has to do with speed/performance: DNS lookups are slow, especially if answers aren't in the cache. If you've ever used tcpdump with an unprimed DNS resolver, you'll have noticed that tcpdump hesitates everytime it prints out a resolved hostname. In doing so, there is a risk that PCAP will drop packets -- and ngrep's primary use case is very rapid, high-throughput packet analysis.

If you wanted to add the functionality, I'd accept a patch for it. FWIW you're the first in almost 20 years to ask for the feature.

Thanks for reaching out.