Provide option to perform reverse DNS lookup of IP addresses

[dasl-]

I love tcpflow, and generally reach for it more often than tcpdump. One small issue I have with tcpflow is it cannot automatically perform reverse DNS on the ip addresses it prints out. Particularly, I'd find this feature useful when running tcpflow with the console print -c option.

For example, tcpdump does this by default. It can be disabled in tcpdump via the -n option:

tcpdump:
...
       -n     Don't convert host addresses to names.  This can be used to avoid DNS lookups.

[simsong]

I'm confused. What would it do with the looked up names?

[dasl-]

Sorry, let me clarify. Here is some example output from tcpdump:

 % sudo tcpdump -i any
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
19:30:58.729513 IP dbfailover002a.c.foobar-mysql-prod.internal.48216 > gcp-ldap-ro-02.c.foobar-ldap-prod.internal.ldap: Flags [.], ack 240372327, win 350, options [nop,nop,TS val 3822553464 ecr 1203028904], length 0
19:30:58.732498 IP dbfailover002a.c.foobar-mysql-prod.internal.58008 > gcp-ldap-ro-07.c.foobar-ldap-prod.internal.ldap: Flags [.], ack 1740409873, win 350, options [nop,nop,TS val 3822553467 ecr 4263789647], length 0
19:30:58.732573 IP dbfailover002a.c.foobar-mysql-prod.internal.ssh > dleibovic.cloudvpn.foobar.com.63924: Flags [P.], seq 215632056:215632252, ack 4119599280, win 77, options [nop,nop,TS val 3822553467 ecr 59021317], length 196
19:30:58.733154 IP localhost.48372 > 127.7.7.7.domain: 60358+ PTR? 235.0.248.10.in-addr.arpa. (43)
19:30:58.733315 IP dbfailover002a.c.foobar-mysql-prod.internal.21905 > dns01.c.foobar-traffic-prod.internal.domain: 9216+ PTR? 235.0.248.10.in-addr.arpa. (43)
19:30:58.735377 IP dns01.c.foobar-traffic-prod.internal.domain > dbfailover002a.c.foobar-mysql-prod.internal.21905: 9216 1/0/0 PTR gcp-ldap-ro-02.c.foobar-ldap-prod.internal. (97)

Observe how it prints out hostnames instead of IP addresses. Whereas here is some example output from tcpflow:

% sudo tcpflow -c -i any
tcpflow: listening on any
010.248.007.223.00022-010.250.005.004.63924: <redacted>
127.000.000.001.47306-127.000.000.001.03306: <redacted>
010.248.007.223.50424-010.253.008.087.02003: <redacted>
010.248.007.223.00022-010.250.005.004.63924: <redacted>

Observe how it prints out IP addresses instead of hostnames.

What would it do with the looked up names?

I would like it to print them out in the console output.

[simsong]

so tcpflow uses host IP addresses for filenames. Do you want the hostnames in the filenames?

Do you want to cache the hostname? What if you are runnon on a pcap file and the mapping of the hostname to DNS name has changed? Do you want the old mapping or the new mapping? Should it learn the DNS from DNS packets in the pcap file? What if DNS packets in the pcap file disagree with the current mapping - which should it use?

[dasl-]

Do you want the hostnames in the filenames?

I only use tcpflow in the console print mode (-c). Perhaps limiting the reverse DNS to console print mode would make some of these decisions easier?

Do you want to cache the hostname?

I assume that would be more performant, so probably

What if you are runnon on a pcap file and the mapping of the hostname to DNS name has changed?

Good question. I wonder what tcpdump does in this case? Does it use hostnames in the pcap file or does it only use IP addresses in the pcap file?

Anyway, I understand that there are some intricacies to work out for this feature. I apologize that I don't feel that I have the expertise to properly answer them. My personal primary use case is simply for printing out hostnames to console output.

[simsong]

Certainly limiting this to the -c mode would make sense.
The DNS system already does caching. My question was whether you wanted separate caching. The issue is with fast-flux hostnames which change every few seconds.
I'm fine with this issue. Would you like to try to write it? I'm happy to give you pointers.

[dasl-]

The DNS system already does caching. My question was whether you wanted separate caching. The issue is with fast-flux hostnames which change every few seconds.

Good point. I don't have a super strong opinion here. I wonder what the performance impact of not doing separate caching would be?

I'm fine with this issue. Would you like to try to write it? I'm happy to give you pointers.

I could try to take a stab. Caveat is that it might take me a few months to find the time. In the offhand chance that you felt the urge to implement it sooner, I wouldn't stop you. Another caveat is that I have very little experience with C / C++ :)

I'd gladly take any pointers you have though!

[simsong]

You should rely on the caching built into the DNS system for most cases.

This would be a great way for you to get more experience with C/C++! I am happy to give you pointers. You should start by writing a stand-alone program (lookup.cpp) that takes an IP address provided on the command line and prints the hostname. Once you have that, then it is a simple matter to add the option to the tcpflow option processing system to turn of the hostname display, and then to add the display and make it the default (to match tcpdump).

Also, do you know that running reverse DNS means that people can learn that you are wiretapping them?