How exactly does tshark -z hosts come up with the list?

jtanski
3 ●2

How exactly does tshark -z hosts come up with the hosts list?

The man page says "Addresses are collected from a number of sources, including standard "hosts" files and captured traffic.".

I am curious to understand what the sources would be. I would assume DNS packets, maybe Windows Netbios or newer Windows protocols?

Thanks.

1 Answer

Sort by » oldest newest most voted

Guy Harris
19890 ●3 ●660 ●207

Just DNS packets, from a quick look at the code; we don't use NBNS traffic to get NetBIOS names.

Thank you, makes sense.

jtanski ( 2019-05-30 18:18:13 +0000 )edit

Please start posting anonymously - your entry will be published after you log in or create a new account.

1 follower

Asked: 2019-05-29 12:23:16 +0000

Seen: 328 times

Last updated: May 30 '19