Name resolution pitfalls
A resolved name in the list is Wireshark’s addition. The address on the wire is the field, unless the packet itself carried a name.
The column can grow a name the packet never had
With network name resolution on, the source and destination columns may show a DNS name instead of an address. That name may come from DNS already in the file, from the hosts file, or from a fresh lookup the analysis machine makes. It is still not a field in the IP header. Turn the view off when the question is “which address was in the header.”
A fresh lookup is traffic. Resolving many addresses queries a resolver from the machine where you are reading the file, and those queries can announce which addresses you are investigating. Prefer names the capture already contains. Disable external resolution when you do not need it.
Some names really are in the packet
DNS query names, TLS server names, HTTP Host headers, and DHCP host names are fields inside frames. Those survive with resolution turned off, because they are dissected from bytes. A column you added for dns.qry.name is evidence. A source column that Wireshark replaced with a reverse lookup is a convenience.
Reverse lookups lie in ordinary ways. The name can be stale, the hosts file can be wrong, and many addresses share a name when a service sits behind a load balancer. Two frames “to the same name” can be two addresses. Record the address. Add the name when the packet carried one.
Worked case: the column said the resolver, the header said something else
A lab note claims 10.8.0.40 talked only to the resolver, because the destination column showed dns.lab.example. Resolution was on, and the analysis machine’s hosts file maps that name to 10.8.0.53. You turn network name resolution off. The same rows show destination 10.8.0.53 for real DNS, and also destination 203.0.113.50, which the hosts file had labeled with a friendly name from an old exercise.
The friendly name hid a second destination. With resolution off, the filter ip.dst == 203.0.113.50 selects those rows, and tls.handshake.extensions_server_name shows the name the client actually sent. That name is in the Client Hello. The earlier column name was in the hosts file. The note gets the address, the SNI, and a line that resolution was disabled before the count.
ip.dst == 203.0.113.50 && tls.handshake.type == 1
Ask tshark not to resolve
tshark resolves unless you tell it not to. Pass -n when you print addresses you intend to quote. The field you extract is still the field, and -n keeps the summary columns from substituting names while you read them.
If you need a name, extract the protocol field that carried it. A DNS name, a server name, or a Host header can be a -T fields column. A reverse lookup can wait until you have a short list worth resolving on purpose.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1" -T fields -e ip.dst -e tls.handshake.extensions_server_name
Diagram
A name in the column and a name in the packet are different evidence
- Off
Turn off network name resolution before you quote an address.
- Field
If you need a name, click the field that was captured: DNS, SNI, or Host.
- Address
Record ip.src and ip.dst from the header.
- Read
Print the same fields with tshark -n so the summary stays numeric.
tshark -n -r lab.pcapng -Y "tls.handshake.type == 1" -T fields -e ip.dst -e tls.handshake.extensions_server_name
Where the name came from
Source. A lookup, a cache, or the hosts file on the analysis machine.
Changes. Turning resolution off changes the column.
Quote. Quote it only as a convenience, next to the address.
Source. Bytes in the frame: dns.qry.name, SNI, or the Host header.
Changes. Resolution settings leave the field alone.
Quote. Quote the field name, the value, and the frame number.
Check yourself
1. The source column shows a hostname and you need the address that was in the IP header. What do you do?
2. With resolution on, Wireshark queries your resolver for addresses in the file. What is that query?
3. You want tshark to print destination addresses without substituting names. What do you add?