Sudden issue with name resoution using hosts file

asked 2024-01-08 19:41:13 +0000

sigtraniac
7 ●1 ●1 ●2

I'm running 4.2.2 on macOS 13.5.1.

Normally, I keep a symoblic link named hosts in /Applications/Wireshark.app/Contents/Resources/share/wireshark/ that points to a curated hosts file of about 2,400 entries that I keep in a OneDrive folder. After each upgrade, I recreate the symbolic link to restore name resolution.

After the last two upgrades (they seem to happen in fairly quick succession) I'm unable to restore name resolution.

Additionally, I've tried the following:

Creating symoblic link to hosts file in /Users/<username>/.local/lib/wireshark/plugins/
Copying hosts file to /Applications/Wireshark.app/Contents/Resources/share/wireshark/
Copying hosts file to /Users/<username>/.local/lib/wireshark/plugins/
Adding a test entry to /etc/hosts

I'm restarting Wireshark after each of these scenarios opening a previous capture to check.

View | Name Resolution | Resolve Network Addresses is checked.
Preferences | Application | Name Resolution | Resove network (IP) addresses is the only checked box under Name Reolution.
No DNS Servers are configured in Preferences

Transport resolution works. Toggling Name Resolution under View or Preferences is ineffective.

Thanks.

Comments

I downgraded to 4.0.12 and name resolution started working again.

I noticed that when recreating the hosts symbolic link, terminal.app had lost full disk access. Thinking that maybe I overlooked this error when performing this task with 4.2.2, I reinstalled 4.2.2 but found name resolution still not working.

Went back to 4.0.12 and name resolution is again working.

sigtraniac ( 2024-01-08 21:45:44 +0000 )edit

add a comment

answered 2024-01-08 21:44:50 +0000

SYN-bit

18344 ●9 ●304 ●255 https://SYN-b.it

There are quite a view elements involved in the name resolution process. Maybe my Sharkfest 2021 US virtual presentation helps in finding the cause of what is working for you.

My guess is that your configuration profile (are you using the default or did you create own?) has a hosts file that "masks" the ones you are trying. Also, the place of the hosts file is not in the plugin directories, but in the profile directories.

I tried the following myself and can confirm that that works in Wireshark-4.2.2:

Switched to the default profile (ie, use the settings in the personal configuration folder instead of a specific profile folder)
created a sym-link from a hosts file on my OneDrive to a hosts file in this configuration folder (~/.config/wireshark/hosts)
Enabled network name resolution and disabled the external resolver and captured DNS packets options

edit flag offensive delete link

Comments

Not sure if you saw the comment I added to my original post but name resolution began working again when I downgraded to 4.0.12.

In any case, based on your response, I reinstalled 4.2.2 and created symlink ~/.config/wireshark/hosts and name resolution was still not working.

I could not find any other hosts file on my system. I've been using a symlinked hosts file for years.

I went through some of your deck and enabling "Use your system's DNS settings..." does work with /etc/hosts. In your deck it was called "Use an external network name resolver."

I then disabled "Use your system's DNS settings..." and ~/.config/wireshark/hosts started working!

I removed the symlink from .config and put it back /Applications/Wireshark.app/Contents/Resources/share/wireshark where it's been for years and it does not work.

So maybe it ...(more)

sigtraniac ( 2024-01-09 00:16:41 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Sudden issue with name resoution using hosts file

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Sudden issue with name resoution using hosts file edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Sudden issue with name resoution using hosts file