This is our old Q&A Site. Please post any new questions and answers at

I would like to enable network name resolution but only allow Wireshark to use its hosts file in %WIRESHARK%\hosts, or %APPDATA%\Wireshark\hostsdisable. It appears that when I enable network name resolution in preferences then it enables name reslution using, DNS, the windows hosts file, and the Wireshark hosts file. I often analyze very large captures from a private network while I'm attached to my corporate network, I do have a large wireshark hosts file but there are many addresses for which I do not have an entry, Wireshark resorts to DNS to attempt to resolve these names and it takes a very long time since many are not reachable and result in a timeout before proceeding. Dos anyone know if there is a way to disable DNS network name resolution while at the same time allowing network name resolution using the Wireshark hosts file?

Thanks for any help!!

asked 14 Sep '10, 22:11

Saninim's gravatar image

accept rate: 0%

edited 10 Jul '12, 18:35

Guy%20Harris's gravatar image

Guy Harris ♦♦

What you want isn't possible, currently, but shouldn't be required. If you check Enable concurrent DNS name resolution in the name resolution preferences the DNS name resolving takes place without blocking further operation.

permanent link

answered 15 Sep '10, 00:07

Jaap's gravatar image

Jaap ♦
accept rate: 14%

According to we can force the use of the local hosts file using ARES_OPT_LOOKUPS. Unfortunately there doesn't seem to be a way to get there. The code that parses the RES_OPTIONS environment variable doesn't provide an option for this, and we don't provide a way to set the flags within Wireshark. This should probably be a wishlist item in Bugzilla.

(15 Sep '10, 10:36) Gerald Combs ♦♦

I added it to the wishlist.

(18 Jun '12, 21:03) cmaynard ♦♦
(19 Jun '12, 01:42) Anders ♦

For the record, the bug is pretty much implemented (although the bug is still open). I also moved the WishList item to the Done section.

(10 Jul '12, 08:25) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 14 Sep '10, 22:11

question was seen: 4,673 times

last updated: 10 Jul '12, 18:35

p​o​w​e​r​e​d by O​S​Q​A