Sure - ntop has both passive and active lookup capabilities. Mostly, ntop is passive - it sniffs the information out of the dns packets it sees. Once it gets going, ntop rarely does dns queries on it's own, e.g.:
Address counts Current Queue.....0 Maximum Queued.....5 Total Queued.....75 Resolved with DNS.....62 Kept Numeric.....13 Found in Cache.....0 DNS responses sniffed.....256 This is because they're expensive and asynchronous. Besides, if you think about it, the average access of a new host is preceded by a lookup so that your web browser (or whatever) can access it. So ntop's usually seen the information before it's needed. When it does an active dns lookup, the code is in address.c, dequeueAddress(). But if you chase it back it's only called in a few cases, protocol.c case 67: /* BOOTP/DHCP: server -> client*/ and in hash.c for new hosts (if it's not already been requested or sniffed - i.e. not found in the cache) You should probably follow this model - and so, while it's clearly possible to add another type of lookup, it will take some careful coding. Have fun... If you want to pursue this, take it to ntop-dev and we'll be happy to talk about designs. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jonathan Wrobel Sent: Thursday, February 06, 2003 4:09 PM To: [EMAIL PROTECTED] Subject: Re: [Ntop] local networks appear as one host??? Hi folks I've just joined the NTOP mailing list and have a quick <generic> question. I understand (from docs/FAQ) that NTOP will show host names based on DNS entries, NETBIOS names and lastly IPs. Is it (or would it be) possible to get NTOP to support /etc/nsswitch.conf (from Solaris and its derivitives) - namely local and NIS? Thanks Jonathan _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
