What are hosts and how hosts information gathered?

[roopeshsn]

What are hosts and how is host information gathered? Whether reverse DNS lookup is being used? If yes, should I use the destination IP address in a packet for reverse DNS lookup, and what other tools or libraries are required for the process?

[GyulyVGC]

Hi @roopeshsn, that's an interesting question.

Sniffnet defines a network host as a tuple made of the following values:

• country
• domain name (more specifically: second level domain + top level domain)
• autonomous system name

The country and the autonomous system name are retrieved performing lookups against MMDB databases, while the domain name is extracted from the fully qualified domain name.
The fully qualified domain name, as you suspected, is obtained performing reverse DNS lookups.

For incoming connections, the source IP address is subject to rDNS lookup; for outgoing connections, the destination IP address is subject to rDNS lookup.
If the rDNS lookup fails, the IP address will be used as default.

I use the dns-lookup crate for this purpose.

Each new connection that has an IP address not already looked up is sent to a separate thread to wait for the reverse resolution.

Let me know if everything's clear and if you need further clarifications.

[roopeshsn]

So Sniffnet has a track of IP addresses, and the corresponding sum of bytes is calculated whenever the same traffic to that IP address is observed.

[GyulyVGC]

Yes. And not only same IP address, but data count is also grouped by host and application protocol.

[roopeshsn]

Thanks!

[roopeshsn]

I have a doubt about packets and bytes calculations. In the image attached, as you can see for the src and dst IP (64.207.204.129 -> 10.233.83.218), the packet count is 5798 and the bytes are 116.2 KB. I believe using pcap lib, one packet is captured at a time. Whether 5798 is an aggregated count value? (I mean counting previous captured packets for the same src and dst IP.)

[GyulyVGC]

Hi @roopeshsn.

As you correctly guessed, pcap captures one packet at a time.
Entries of that table, instead, reports aggregated values.

More specifically, the table in inspect page reports values grouped by the networking 5-tuple; this means that each line of the table is uniquely identified by the set of:

• source IP
• source port
• destination IP
• destination port
• layer 4 protocol

Each time a new packet is processed, the packets and bytes count of the respective entry is incremented.

[GyulyVGC]

Also, I'm sorry that you're are being affected by the dealignement bug.

This issue has been fixed in #442 and will be officially release in v1.3.0 😄

[roopeshsn]

Hi @roopeshsn.

As you correctly guessed, pcap captures one packet at a time. Entries of that table, instead, reports aggregated values.

More specifically, the table in inspect page reports values grouped by the networking 5-tuple; this means that each line of the table is uniquely identified by the set of:

• source IP
• source port
• destination IP
• destination port
• layer 4 protocol

Each time a new packet is processed, the packets and bytes count of the respective entry is incremented.

So if a packet comes again with those 5 parameters, then you'll increment the packet count and aggregate bytes field so that no duplicates will be in the table, right?

[GyulyVGC]

Right.

[roopeshsn]

The graph is plotted with time against bytes/packets right? As you mentioned about the aggregation part previously, those values will not be plotted because they are accumulated data. The graph will be plotted with time against bytes/packets captured at that second. Am I right? or correct me if I am wrong.

[GyulyVGC]

Hi Roopesh, yes this is perfectly correct.

If it can help, you can see it in another way: the data discussed previously are aggregated by host, while the data displayed in the chart are aggregated by time interval (1 second).

So in practice they are still aggregated but by the time they were exchanged, even if just the latest 30 seconds are displayed in the chart.

[GyulyVGC]

Data aggregated by host instead refers to the whole capture, not just to the last 30 seconds.
To make things slightly clearer, some days ago I merged #452 that shows host sorted by most recent date by default.
In this way the displayed hosts are consistent with the data in the chart, even if still they refer to the whole analysis, and the chart just to the last 30 seconds.

[roopeshsn]

Thanks, Giuliano! Could you point me to the code that is aggregated by time?

[GyulyVGC]

Most of it is in the chart folder: https://github.com/GyulyVGC/sniffnet/tree/main/src/chart