How to convert source and destination ip address to host names, i was trying to open datasets of netflow data traces or wireless strength data traces. when i go to edit>preferences and enable the name resolution options nothing really works on wireshark 2.03 asked 06 May '16, 11:36  prajwal edited 20 Jul '16, 15:52  cmaynard ♦♦ |
2 Answers:
Name resolution should work as you expect--assuming that the computer you're running Wireshark on now has access to a DNS server (or hosts file) that can resolve those IP addresses to names. (As Shawn points out it can also be done based on DNS packets you captured. But normally name resolution does not need to enabled while you're capturing.) Two possibilities exist:
answered 06 May '16, 15:26  JeffMorriss ♦ |
Hi prajwal, Convert source and destination ip addresses to host names where? If you mean in the WireShark Packet List pane, then go to Capture Interfaces > Options tab > Name Resolution and check "Resolve network names". In short, it must be done in Capture > Options > Options tab > Name Resolution before a particular capture, not just enabled globally in Edit > Preferences. This must be done before the capture is started. This will actually create DNS "PTR" queries against whatever DNS resolvers you have configured in your operating system settings. Hope this helps, Shawn answered 06 May '16, 13:28  shawncarroll edited 06 May '16, 13:32 I was opening files previously captured which I have downloaded on internet. Some suggested me that she saw other guy replacing them with hostname, we could also convert the source IP addresses in that files also, You are saying that it couldn't be done I will just inform her we can't unless its live capture. (06 May '16, 13:54) prajwal Your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information. (06 May '16, 14:41) Jaap ♦ As mentioned in my answer, there's normally no reason you need to enable name resolution while capturing; name resolution should work after a capture is done too. (06 May '16, 15:27) JeffMorriss ♦ |
Hi Jeff,
I did try out adding filters as u mentioned in bug12384, but no help either.
I was using my work laptop i will try accessing in my personal pc.
let you guys know if any update.
What about the first question (do you have external name resolution enabled)?
One thing you could check is whether your PC is generating name requests--using Wireshark of course :-).
I apologize if I underestimate you, but are the IP addresses you want to convert to hostnames public ones? I.e. does any PTR record actually exist for them anywhere? Even if they are public, what does
nslookup ip.add.re.ss(Windows) ordig -x ip.add.re.ss(Linux) show for these addresses? Even some public addresses miss a PTR record in DNS so they cannot be resolved to hostnames.Also, as you specifically mention Wireshark 2.0.3 and specific types of capture files (which don't sound like pcap or pcapng to me), the best thing would be if you could publish, login-free, an example of a real file you deal with in each of those formats somewhere (cloudshark is preferred by this site's community but may possibly not like non-pcap(ng) files, so in this particular case better use Dropbox, Google Drive, ...) and put links to them here. This should give us a better insight on the root cause of your issue.