First off, I assume you are referring to the Stats | Hosts report ("Host
Information"). You don't say...
There is only ONE case where ntop uses the NetBIOS names, which is if it
can't resolve them via DNS (both it's own queries and responses to other's
queries sniffed off the network):
void updateHostName(HostTraffic *el) {
if((el->hostNumIpAddress[0] == '\0')
|| (el->hostSymIpAddress == NULL)
|| strcmp(el->hostSymIpAddress, el->hostNumIpAddress) == 0) {
int i;
if(el->nbHostName != NULL) {
/*
Use NetBIOS name (when available) if the
IP address has not been resolved.
*/
memset(el->hostSymIpAddress, 0, sizeof(el->hostSymIpAddress));
strcpy(el->hostSymIpAddress, el->nbHostName);
} else if(el->ipxHostName != NULL)
strcpy(el->hostSymIpAddress, el->ipxHostName);
else if(el->atNodeName != NULL)
strcpy(el->hostSymIpAddress, el->atNodeName);
if(el->hostSymIpAddress[0] != '\0')
for(i=0; el->hostSymIpAddress[i] != '\0'; i++)
el->hostSymIpAddress[i] = (char)tolower(el->hostSymIpAddress[i]);
}
}
ntop doesn't SEND NetBIOS queries, it sniffs them off the traffic already on
the network:
void handleNetbios(HostTraffic *srcHost,
HostTraffic *dstHost,
u_short sport,
u_short dport,
u_int packetDataLength,
const u_char* packetData,
u_int length,
u_int hlen) {
u_char *name, nbName[64], domain[64], *data;
int nodeType, i, udpDataLen;
char *tmpdata = (char*)packetData + (hlen + sizeof(struct udphdr));
u_char *p;
int offset=0, displ, notEnoughData = 0;
if((!myGlobals.enablePacketDecoding)
|| (!((srcHost->nbHostName == NULL) || (srcHost->nbDomainName ==
NULL))))
return; /* Already set */
...
} else if((sport == 139) || (dport == 139)) {
if(udpDataLen > 32) {
/* 32 bytes or less is not enough */
data = (char*)malloc(udpDataLen);
memcpy(data, tmpdata, udpDataLen);
if(data[0] == 0x81) /* Session request */ {
char decodedStr[64];
int pos;
pos = 5;
decodeNBstring(&data[5], decodedStr);
if((decodedStr[0] != '\0') && (dstHost->nbHostName == NULL))
dstHost->nbHostName = strdup(decodedStr); /* dst before src */
pos = 5+(2*strlen(decodedStr))+2;
decodeNBstring(&data[pos], decodedStr);
if((decodedStr[0] != '\0') && (srcHost->nbHostName == NULL))
srcHost->nbHostName = strdup(decodedStr);
} else if((data[0] == 0x0) /* Message type: Session message */
...
So, if you have a properly functioning DNS, you'll see DNS names. If these
are (for example) internal names, unknown to the DNS server, you'll see
NetBIOS names if they are available. Lastly, you'll get IP addresses...
If you do have a DNS, and the name is resolved as part of the default
domain, you won't see a fully qualified name back from the DNS, so ntop
won't have that information. So, you'll often get a mix:
Host IP Address MAC Address Other
Name(s) ...
netnews.attbi.com 63.240.76.16
...
tigger.homeportal.2wire.net 192.168.0.xx 00:D0:09:xx:xx:xx
...
homeportal.homeportal.2wire.net 192.168.0.1 00:D0:9E:xx:xx:xx
...
swallowtail 192.168.0.XX 00:A0:CC:xx:xx:xx
SWALLOWTAIL [STRAUSS] ...
12-xxx-xxx-xxx.client.attbi.com 12.xxx.xxx.xxx 00:D0:9E:06:38:80
...
12-xxx-xxx-yyy.client.attbi.com 12.xxx.xxx.yyy
...
The answer to your question? How do I see fully qualified names for all my
hosts? Make sure they are in the DNS and that you're not using default
domains as part of your query resolution.
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Frank
Raiser
Sent: Saturday, June 15, 2002 12:59 PM
To: [EMAIL PROTECTED]
Subject: Re: [Ntop] IP displaying and more
<snip />
> * In the hosts analysis as seen on the webpage the hosts
> are referred to with names instead of IPs. It looks to me
> like those names are the netbios names of those hosts, but
> what I wonder is why some hosts don't get an entry in the IP
> column? I tried the -n switch but that didn't change it.
> So basically I get 3 cases:
> <IP>.. <IP>
> <Name>..<IP>
> <Name>..<Nothing>
> And I liked to have all IPs appearing there. Any hints?
--
Raiser, Frank
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://lists.ntop.org/mailman/listinfo/ntop
