This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I would like to enable network name resolution but only allow Wireshark to use its hosts file in %WIRESHARK%\hosts, or %APPDATA%\Wireshark\hostsdisable. It appears that when I enable network name resolution in preferences then it enables name reslution using, DNS, the windows hosts file, and the Wireshark hosts file. I often analyze very large captures from a private network while I'm attached to my corporate network, I do have a large wireshark hosts file but there are many addresses for which I do not have an entry, Wireshark resorts to DNS to attempt to resolve these names and it takes a very long time since many are not reachable and result in a timeout before proceeding. Dos anyone know if there is a way to disable DNS network name resolution while at the same time allowing network name resolution using the Wireshark hosts file?

Thanks for any help!!

asked 14 Sep '10, 22:11

Saninim's gravatar image

Saninim
16112
accept rate: 0%

edited 10 Jul '12, 18:35

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


What you want isn't possible, currently, but shouldn't be required. If you check Enable concurrent DNS name resolution in the name resolution preferences the DNS name resolving takes place without blocking further operation.

permanent link

answered 15 Sep '10, 00:07

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

According to http://c-ares.haxx.se/ares_init.html we can force the use of the local hosts file using ARES_OPT_LOOKUPS. Unfortunately there doesn't seem to be a way to get there. The code that parses the RES_OPTIONS environment variable doesn't provide an option for this, and we don't provide a way to set the flags within Wireshark. This should probably be a wishlist item in Bugzilla.

(15 Sep '10, 10:36) Gerald Combs ♦♦

I added it to the wishlist.

(18 Jun '12, 21:03) cmaynard ♦♦
(19 Jun '12, 01:42) Anders ♦
2

For the record, the bug is pretty much implemented (although the bug is still open). I also moved the WishList item to the Done section.

(10 Jul '12, 08:25) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×109
×13

question asked: 14 Sep '10, 22:11

question was seen: 4,188 times

last updated: 10 Jul '12, 18:35

p​o​w​e​r​e​d by O​S​Q​A