On Wed, May 15, 2002 at 09:52:46PM -0700, Harry Putnam wrote: > What does it mean in a tcpdump line of output with this command line: > > tcpdump -i eth1 src host some.local.host > > And I see a few lines like this come up: > > 21:30:53.099811 my.local.host.support > \ > some.multi.part.internet.add.http: . ack 291 win 8471 (DF) > > What does the `support' extension mean?
It probably means that when tcpdump called "gethostbyaddr()" to resolve the source IP address of that packet, the host name resolution code in the OS running on the machine on which tcpdump was running gave "my.local.host.support" as the full name (tcpdump doesn't resolve IP addresses to names itself, it just calls the OS routine "gethostbyaddr()" to do that), and that the host name resolution code on that machine is configured to look up names in the ".support" subdomain, so that it can find an IP address for "my.local.host" by finding it as "my.local.host.support". (I.e., little if any of that is a consequence of the way tcpdump works; it's mainly, and probably completely, a consequence of the way host name resolution works on your machine.) - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
