Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2020-12-15 04:26:36 +0000

Chuckc gravatar image

"Or is there a better way to do manipulations in the hosts file?"
The User's Guide has a section on Name Resolution and the hosts Configuration File

"Is there a kind of cache within Wireshark for hostnames?"
Yes, if the capture file is stored as a pcapng file. This data is stored in a Name Resolution Block (NRB) within the pcapng file.
@cmaynard mentioned open issue 11470 where comments can be added about the name resolution process.

At this time, if a capture file has a NRB it wins when the file is opened.
The NRB can be removed from a file with tshark:

$ capinfos -n 201214_local_name_resolution.pcapng
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

$ tshark -r 201214_local_name_resolution.pcapng -F pcapng -w 201214_no_nrb.pcapng

$ capinfos -n 201214*
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

File name:           201214_no_nrb.pcapng


Or if using a hosts file in the search path as described in the User's Guide Configuration File, ask Wireshark to redo name resolution.

  1. Open the capture file.
  2. Edit -> Preferences... -> Name Resolution - uncheck Resolve network (IP) addresses then OK

  3. Edit -> Preferences... -> Name Resolution - check Resolve network (IP) addresses then OK

    The hover text for "Resolve network (IP) addresses":

        "Resolve IPv4, IPv6, and IPX addresses into host names."
    " The next set of check boxes determines how name resolution should be performed."
    " If no other options are checked name resolution is made from Wireshark's host file"
    " and capture file name resolution blocks."<br>


    but Use an external network name resolver must be checked also. Will link issue 11470 back to this question.
    Note: Reloading the capture file resets the name resolution to information in the NRB.

    To see the contents of the NRB, View -> Reload as File Format/Capture

image description

"Or is there a better way to do manipulations in the hosts file?"
The User's Guide has a section on Name Resolution and the hosts Configuration File

"Is there a kind of cache within Wireshark for hostnames?"
Yes, if the capture file is stored as a pcapng file. This data is stored in a Name Resolution Block (NRB) within the pcapng file.
@cmaynard mentioned open issue 11470 where comments can be added about the name resolution process.

At this time, if a capture file has a NRB it wins when the file is opened.
The NRB can be removed from a file with tshark:

$ capinfos -n 201214_local_name_resolution.pcapng
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

$ tshark -r 201214_local_name_resolution.pcapng -F pcapng -w 201214_no_nrb.pcapng

$ capinfos -n 201214*
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

File name:           201214_no_nrb.pcapng


Or if using a hosts file in the search path as described in the User's Guide Configuration File, ask Wireshark to redo name resolution.

  1. Open the capture file.
  2. Edit -> Preferences... -> Name Resolution - uncheck Resolve network (IP) addresses then OK

  3. Edit -> Preferences... -> Name Resolution - check Resolve network (IP) addresses then OK

    The hover text for "Resolve network (IP) addresses":

        "Resolve IPv4, IPv6, and IPX addresses into host names."
    " The next set of check boxes determines how name resolution should be performed."
    " If no other options are checked name resolution is made from Wireshark's host file"
    " and capture file name resolution blocks."<br>


    but Use an external network name resolver must be checked also. Will link issue 11470 back to this question.
    Note: Reloading the capture file resets the name resolution to information in the NRB.

    To see the contents of the NRB, View -> Reload as File Format/Capture

image description

"Or is there a better way to do manipulations in the hosts file?"
The User's Guide has a section on Name Resolution and the hosts Configuration File

"Is there a kind of cache within Wireshark for hostnames?"
Yes, if the capture file is stored as a pcapng file. This data is stored in a Name Resolution Block (NRB) within the pcapng file.
@cmaynard mentioned open issue 11470 where comments can be added about the name resolution process.

At this time, if a capture file has a NRB it wins when the file is opened.
The NRB can be removed from a file with tshark:

$ capinfos -n 201214_local_name_resolution.pcapng
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

$ tshark -r 201214_local_name_resolution.pcapng -F pcapng -w 201214_no_nrb.pcapng

$ capinfos -n 201214*
File name:           201214_local_name_resolution.pcapng
Number of resolved IPv4 addresses in file: 20

File name:           201214_no_nrb.pcapng


Or if using a hosts file in the search path as described in the User's Guide Configuration File, ask Wireshark to redo name resolution.

  1. Open the capture file.
  2. Edit -> Preferences... -> Name Resolution - uncheck Resolve network (IP) addresses then OK

  3. Edit -> Preferences... -> Name Resolution - check Resolve network (IP) addresses then OK

    The hover text for "Resolve network (IP) addresses":

        "Resolve IPv4, IPv6, and IPX addresses into host names."
    " The next set of check boxes determines how name resolution should be performed."
    " If no other options are checked name resolution is made from Wireshark's host file"
    " and capture file name resolution blocks."<br>


    but Use an external network name resolver must be checked also. Will link issue 11470 back to this question.
    Note: Reloading the capture file resets the name resolution to information in the NRB.

    To see the contents of the NRB, View -> Reload as File Format/Capture

image description

Edit 201215: update link to NRB