Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When running commands like netstat or snoop,, I would like not to reverse lookup because there are cases when either the number converts to name which converts to different number or the number converts to name which converts to multiple or unpredictable numbers.

However,, I still would like reverse lookups to continue for items in /etc/hosts

share|improve this question
    
Why do your forward and reverse DNS names not match up? –  jgoldschrafe Dec 30 '10 at 20:12
    
They are not my forward and reverse names. They are from outside traffic. They usually match up... but not always. –  George Bailey Dec 30 '10 at 23:15

4 Answers 4

up vote -1 down vote accepted

i think if it was like linux in /etc/resolv.conf you have entry

order hosts,bind

hosts is to try hosts first, bind is to fallback on dns if /etc/hosts didnt succeed

share|improve this answer

DNS settings, as a general rule, are machine-wide. You could turn off your DNS resolution, filter it, or give false answers -- but I bet you don't want to do that. I think your best answer is to run them with lookups disabled (e.g., netstat -n) and then run the output through a script that checks against /etc/hosts and does the proper replacements.

share|improve this answer

netstat has options that just return numbers without translating them e.g. netstat -n will return IP address, port, user as numbers; netstat --numeric-hosts will translate everything but the IP address.

My reading of the snoop man page suggests that it does capture the IP address, and you need to run a capture file through it with the -N flag to get hostname translation. This suggests that you may be using another tool reliant on snoop which is requesting the results use lookups to get hostnames.

Perhaps your question is a bit leading in naming those two tools. Can you give a bit more information on what you are trying to achieve here? Maybe you need to string a bunch of commands together to get exactly what you want. I think most unix network tools have a flag to toggle lookups.

share|improve this answer
    
netstat "--numeric-hosts" option is Linux specific or at least non Solaris. The traditional Unix netstat implemented by Solaris doesn't support gnu style long options. –  jlliagre Dec 30 '10 at 19:58

As already stated, use netstat -n to disable name resolution. The corresponding option when capturing traffic with snoop is snoop -r, however, I believe it only appeared with OpenSolaris/Solaris 11 Express so might not be available to you should you use Solaris 10 or older..

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.