Table of Contents
- Analysis
- src/analysis/apps.c
- src/analysis/hosts.c
- ip_len in hosts
- ip_hash
- entry_find
- hostmap_new
- hostmap_free
- evict_oldest
- hostmap_set
- hostmap_find
- hostmap_get
- src/analysis/renames.c
- rename_delete
- rename_remove
- rename_append
- rename_set_auto
- rename_set
- renames_free
- renames_print
- address_char
- matches_at
- longest_match
- renames_write
- src/analysis/reverse.c
- find_sent
- handle_answer
- new_query_id
- send_query
- open_resolver
- reverse_tick
- reverse_toggle_online
- reverse_free
- src/analysis/reverse_dns.c
- src/analysis/reverse_log.c
- print_address
- log_free
- log_entry_new
- log_drop_oldest
- log_add
- log_print
- log_clear
- reverse_log_print
- reverse_log_print_all
- src/analysis/reverse_queue.c
- ip_len in reverse_queue
- ipv4_skipped
- ipv6_skipped
- skipped_address
- find_entry
- needs_lookup
- queue_address
- reverse_queue_packet
- reverse_queue_lookups
- src/analysis/reverse_store.c
- ip_len in reverse_store
- answer_bucket
- reverse_answer_find
- reverse_record_put
- reverse_record_get
- cache_disable
- write_all
- cache_create
- cache_append
- reverse_answer_add
- cache_read
- print_loaded
- cache_parse
- reverse_cache_load
- print_origin
- reverse_store_print
- reverse_store_free
- src/analysis/view.c
Analysis
The analysis view: renamings, the hostname map, apps, and the reverse DNS lookups (the only packets NetOtter sends).
Generated by make docs from the source and GCC's call graph. Back to the Function explorer.
src/analysis/apps.c
Hostname -> application (analysis view): which app a server belongs to, from the domain names it was learned with
lower
static char lower(char c)
src/analysis/apps.c:13 · static · both builds
Called by: host_matches
host_matches
static int host_matches(const char *host, int host_len, const char *suffix, int suffix_len)
src/analysis/apps.c:20 · static · both builds
1 if host is suffix or ends with "." + suffix (ignoring case: DNS names can come in mixed case)
Called by: app_lookup
Calls: lower
app_lookup
const char *app_lookup(const char *host, const char **category)
src/analysis/apps.c:35 · non-static · both builds
src/analysis/apps.c The application a hostname belongs to ("Instagram"), from the domain list, NULL if it's unknown. *category gets its 5-char category ("SCLNW") when category isn't NULL. (from
includes/hosts.h)
Called by: ip_category, packet_host_app
Calls: host_matches, my_strlen
src/analysis/hosts.c
The IP -> hostname map of the analysis view
ip_len in hosts
static int ip_len(int1 v6)
src/analysis/hosts.c:12 · static · both builds
Called by: entry_find, hostmap_set
ip_hash
static uint32_t ip_hash(int1 v6, const uint8_t *ip)
src/analysis/hosts.c:17 · static · both builds
Called by: entry_find, evict_oldest, hostmap_set
Calls: ip_fnv1a
entry_find
static host_entry_t *entry_find(hostmap_t *map, int1 v6, const uint8_t *ip)
src/analysis/hosts.c:22 · static · both builds
Called by: hostmap_set, hostmap_find
Calls: ip_len (hosts.c), ip_hash
Library and system calls: memcmp
hostmap_new
hostmap_t *hostmap_new(void)
src/analysis/hosts.c:32 · non-static · both builds
src/analysis/hosts.c NULL if the allocation fails (from
includes/hosts.h)
Called by: netotter_new
Library and system calls: malloc, memset
hostmap_free
void hostmap_free(hostmap_t *map)
src/analysis/hosts.c:42 · non-static · both builds
Called by: netotter_delete
Calls: quic_flows_free
Library and system calls: free
evict_oldest
static void evict_oldest(hostmap_t *map)
src/analysis/hosts.c:60 · static · both builds
Forgets the oldest learned name: off its bucket and the age list
Called by: hostmap_set
Calls: ip_hash
Library and system calls: free
hostmap_set
int hostmap_set(hostmap_t *map, int1 v6, const uint8_t *ip, const char *name, int1 passive)
src/analysis/hosts.c:76 · non-static · both builds
Maps ip (4 bytes, 16 with v6) to name, replacing an older name. passive: learned from the traffic (saved in .nto files), not from a reverse DNS answer. 0 on success, 1 if an allocation fails. (from
includes/hosts.h)
Called by: dns_learn, sni_from_extension, reverse_answer_add, load_hosts
Calls: ip_len (hosts.c), ip_hash, entry_find, evict_oldest, str_dup
Library and system calls: free, malloc, memcpy, memset
hostmap_find
host_entry_t *hostmap_find(hostmap_t *map, int1 v6, const uint8_t *ip)
src/analysis/hosts.c:116 · non-static · both builds
The entry of ip, NULL if it's unknown (or map is NULL) (from
includes/hosts.h)
Called by: hostmap_get, anom_direct_settle, print_outside, mark_host
Calls: entry_find
hostmap_get
const char *hostmap_get(hostmap_t *map, int1 v6, const uint8_t *ip)
src/analysis/hosts.c:121 · non-static · both builds
The name of ip, NULL if it's unknown (or map is NULL) (from
includes/hosts.h)
Called by: ip_category, packet_host_app, print_host_info, needs_lookup, reverse_answer_add
Calls: hostmap_find
src/analysis/renames.c
The renamings of the analysis view, and their replacement in a text
rename_delete
static void rename_delete(rename_t *node)
src/analysis/renames.c:13 · static · both builds
Called by: rename_remove, renames_free
Library and system calls: free
rename_remove
static int rename_remove(rename_t **list, const char *from)
src/analysis/renames.c:21 · static · both builds
Removes the renaming of from. 0 on success, 1 if there is none.
Called by: rename_set
Calls: rename_delete
Library and system calls: strcmp
rename_append
static int rename_append(rename_t **list, const char *from, const char *to, enum RENAME_KIND kind)
src/analysis/renames.c:37 · static · both builds
Appends from -> to. 0 on success, 1 if an allocation fails.
Called by: rename_set_auto, rename_set
Calls: str_dup
Library and system calls: free, malloc
rename_set_auto
int rename_set_auto(rename_t **list, const char *from, const char *to, enum RENAME_KIND kind)
src/analysis/renames.c:61 · non-static · both builds
An automatic renaming (RN_IPV4 / RN_IPV6), added only if from isn't renamed yet: the user's renamings always win. 0 on success or if it was already there, 1 if an allocation fails. (from
includes/analysis.h)
Called by: local_sync_renames
Calls: rename_append
Library and system calls: strcmp
rename_set
int rename_set(rename_t **list, const char *from, const char *to)
src/analysis/renames.c:72 · non-static · both builds
src/analysis/renames.c Adds from -> to, or replaces the new name if from is already renamed. With to NULL, removes the renaming of from. 0 on success, 1 if from isn't renamed (removal) or an allocation fails. (from
includes/analysis.h)
Called by: rename_rm, rename_command, load_renames
Calls: rename_remove, rename_append, str_dup
Library and system calls: free, strcmp
renames_free
void renames_free(rename_t *list)
src/analysis/renames.c:95 · non-static · both builds
Called by: netotter_delete
Calls: rename_delete
renames_print
void renames_print(rename_t *list, int output_buffer)
src/analysis/renames.c:106 · non-static · both builds
One "text -> new name" per line, or "No renaming" (from
includes/analysis.h)
Called by: rename_command
Calls: my_putstr
address_char
static int address_char(char c, enum RENAME_KIND kind, int1 after)
src/analysis/renames.c:123 · static · both builds
1 if c could continue an address of that kind: then a match next to it is only part of a longer address (192.0.2.10 inside 192.0.2.103, ::1 inside fe80::1). ':' may follow an IPv4 address (its port).
Called by: matches_at
matches_at
static int matches_at(rename_t *node, const char *text, int pos, int len, int from_len)
src/analysis/renames.c:135 · static · both builds
1 if list's "from" is at text[pos] (len chars in all), as a whole address for the automatic kinds
Called by: longest_match
Calls: address_char
Library and system calls: memcmp
longest_match
static rename_t *longest_match(rename_t *list, const char *text, int pos, int len)
src/analysis/renames.c:149 · static · both builds
The longest renaming that matches at text[pos], NULL if there is none
Called by: renames_write
Calls: matches_at, my_strlen
renames_write
void renames_write(rename_t *list, const char *text, int len, int output_buffer)
src/analysis/renames.c:167 · non-static · both builds
Writes text with every renamed part replaced: at each position, the longest matching "from" wins (from
includes/analysis.h)
Called by: view_end
Calls: longest_match, my_putstr, my_strlen, my_write
src/analysis/reverse.c
NetOtter's own reverse DNS lookups (online mode): the exchange with the resolver. These are the only packets NetOtter sends, so each one is announced and logged.
find_sent
static reverse_entry_t *find_sent(reverse_t *rv, uint16_t id)
src/analysis/reverse.c:15 · static · both builds
Called by: handle_answer, new_query_id
handle_answer
static void handle_answer(netotter_t *netotter, const uint8_t *m, int len)
src/analysis/reverse.c:26 · static · both builds
One datagram read from the resolver socket: always logged, then a definite answer (a name, or none) is stored: its name goes to the host map (a name learned passively stays) and it's added to the cache file
Called by: reverse_tick
Calls: find_sent, ptr_answer_name, log_add, reverse_answer_add, get16
new_query_id
static int new_query_id(reverse_t *rv, lib_common_t *os_lib, uint16_t *id)
src/analysis/reverse.c:47 · static · both builds
A random id for a new query, from the OS: predictable ids would make a forged answer easier to slip in. Never one a query still waiting uses. 0 on success, 1 if there's no random source.
Called by: send_query
Calls: find_sent, random_bytes, random_bytes
send_query
static int send_query(netotter_t *netotter, lib_common_t *os_lib, reverse_entry_t *entry)
src/analysis/reverse.c:60 · static · both builds
Sends one queued lookup and prints it. 0 on success, 1 if it failed.
Called by: reverse_tick
Calls: new_query_id, build_query, log_add, my_putunbr, my_putstr, resolver_send, resolver_send
Library and system calls: time
open_resolver
static int open_resolver(netotter_t *netotter, lib_common_t *os_lib)
src/analysis/reverse.c:93 · static · both builds
Opens the resolver socket the first time a lookup is waiting. 1 if it's open.
Called by: reverse_tick
Calls: my_putstr, resolver_open, random_bytes, resolver_open, random_bytes
reverse_tick
void reverse_tick(netotter_t *netotter, lib_common_t *os_lib)
src/analysis/reverse.c:128 · non-static · both builds
Sends the queued lookups (opening the resolver socket the first time), reads the answers and drops the ones that timed out. Every query sent and every answer read is printed with its hexdump. (from
includes/reverse.h)
Called by: run_interactive
Calls: handle_answer, send_query, open_resolver, log_add, my_putunbr, my_putstr, resolver_recv, resolver_recv
Library and system calls: time
reverse_toggle_online
void reverse_toggle_online(netotter_t *netotter, lib_common_t *os_lib, int1 online)
src/analysis/reverse.c:168 · non-static · both builds
Online / offline: going offline closes the resolver socket and drops the lookups not answered yet (from
includes/reverse.h)
Called by: online_command
Calls: resolver_close, resolver_close
Library and system calls: free
reverse_free
void reverse_free(reverse_t *reverse)
src/analysis/reverse.c:195 · non-static · both builds
Called by: netotter_delete
Calls: log_clear, reverse_store_free
Library and system calls: free
src/analysis/reverse_dns.c
The DNS messages of the reverse lookups: building a PTR query, reading the name out of its answer
ip_len in reverse_dns
static int ip_len(int1 v6)
src/analysis/reverse_dns.c:12 · static · both builds
Called by: build_query
put_label
static int put_label(uint8_t *q, const char *text, int len)
src/analysis/reverse_dns.c:18 · static · both builds
One label: length byte, then the text
Called by: build_query
Library and system calls: memcpy
build_query
int build_query(uint8_t *q, uint16_t id, int1 v6, const uint8_t *ip)
src/analysis/reverse_dns.c:25 · non-static · both builds
src/analysis/reverse_dns.c The PTR query for ip: "4.3.2.1.in-addr.arpa" for IPv4, one label per nibble under "ip6.arpa" for IPv6, recursion desired. Returns its length. (from
includes/reverse.h)
Called by: send_query
Calls: ip_len (reverse_dns.c), put_label
Library and system calls: memset
ptr_answer_name
int ptr_answer_name(const uint8_t *m, int len, char *name)
src/analysis/reverse_dns.c:61 · non-static · both builds
The first PTR name of an answer into name: 1 if there is one, 0 if the resolver says there's none (NXDOMAIN, or no PTR record), -1 if the answer settles nothing (malformed, truncated, server failure, refused): only the first two are stored. (from
includes/reverse.h)
Called by: handle_answer
Calls: dns_read_name, get16
src/analysis/reverse_log.c
What NetOtter's own lookups did, kept for 'd' / 'D': every query sent and answer read, with its bytes, and the timeouts
print_address
static void print_address(int1 v6, const uint8_t *ip, int output_buffer)
src/analysis/reverse_log.c:14 · static · both builds
Called by: log_print
Calls: print_ipv4_raw, print_ipv6_raw
log_free
static void log_free(reverse_log_t *entry)
src/analysis/reverse_log.c:22 · static · both builds
Called by: log_drop_oldest, log_clear
Library and system calls: free
log_entry_new
static reverse_log_t *log_entry_new(reverse_log_t *model, const char *name, const uint8_t *bytes)
src/analysis/reverse_log.c:31 · static · both builds
A copy of model with its own name and bytes (a copy that fails stays NULL: the entry is still logged). NULL if the allocation fails.
Called by: log_add
Calls: str_dup
Library and system calls: malloc, memcpy
log_drop_oldest
static void log_drop_oldest(reverse_t *rv)
src/analysis/reverse_log.c:48 · static · both builds
Drops the oldest log entry, even if 'd' hasn't printed it yet
Called by: log_add
Calls: log_free
log_add
void log_add(reverse_t *rv, reverse_log_t *model, const char *name, const uint8_t *bytes)
src/analysis/reverse_log.c:59 · non-static · both builds
src/analysis/reverse_log.c Appends a log entry for 'd' (copying name and bytes), dropping the oldest one past REVERSE_LOG_MAX. Out of memory, the entry is lost. (from
includes/reverse.h)
Called by: handle_answer, send_query, reverse_tick
Calls: log_entry_new, log_drop_oldest
log_print
static void log_print(reverse_t *rv, reverse_log_t *e, int output_buffer)
src/analysis/reverse_log.c:78 · static · both builds
One log entry, as it used to be printed live
Called by: reverse_log_print, reverse_log_print_all
Calls: print_hexdump, print_address, my_putunbr, my_putstr
log_clear
void log_clear(reverse_t *rv)
src/analysis/reverse_log.c:102 · non-static · both builds
Frees every log entry (from
includes/reverse.h)
Called by: reverse_free
Calls: log_free
reverse_log_print
void reverse_log_print(reverse_t *reverse, int output_buffer)
src/analysis/reverse_log.c:116 · non-static · both builds
'd': prints the stored answers no 'd' has shown yet (reverse_store_print), then the log entries added since the last 'd' (queries sent, answers read, timeouts), each datagram with its hexdump (from
includes/reverse.h)
Called by: netotter, process_keybind
Calls: log_print, reverse_store_print, my_putstr
reverse_log_print_all
void reverse_log_print_all(reverse_t *reverse, int output_buffer)
src/analysis/reverse_log.c:129 · non-static · both builds
'D': the same, but everything: every stored answer, then the whole log (its last 10000 entries). What 'd' will print next doesn't change. (from
includes/reverse.h)
Called by: process_keybind
Calls: log_print, reverse_store_print, my_putstr
src/analysis/reverse_queue.c
Which addresses NetOtter looks up: those the shown packets carry with no name yet, never twice, never one nobody would answer for (loopback, multicast...)
ip_len in reverse_queue
static int ip_len(int1 v6)
src/analysis/reverse_queue.c:13 · static · both builds
Called by: find_entry, queue_address
ipv4_skipped
static int ipv4_skipped(const uint8_t *ip)
src/analysis/reverse_queue.c:20 · static · both builds
0.0.0.0, 127.0.0.0/8 (loopback), 224.0.0.0/4 (multicast) and 255.255.255.255 (broadcast)
Called by: skipped_address
Library and system calls: memcmp
ipv6_skipped
static int ipv6_skipped(const uint8_t *ip)
src/analysis/reverse_queue.c:31 · static · both builds
:: (unspecified), ::1 (loopback) and ff00::/8 (multicast)
Called by: skipped_address
Library and system calls: memcmp
skipped_address
static int skipped_address(int1 v6, const uint8_t *ip)
src/analysis/reverse_queue.c:42 · static · both builds
Addresses nobody would answer for: unspecified, broadcast, multicast and loopback
Called by: needs_lookup
Calls: ipv4_skipped, ipv6_skipped
find_entry
static reverse_entry_t *find_entry(reverse_t *rv, int1 v6, const uint8_t *ip)
src/analysis/reverse_queue.c:47 · static · both builds
Called by: needs_lookup
Calls: ip_len (reverse_queue.c)
Library and system calls: memcmp
needs_lookup
static int needs_lookup(netotter_t *netotter, int1 v6, const uint8_t *ip)
src/analysis/reverse_queue.c:60 · static · both builds
1 if the address is worth a lookup. Never twice: not an address asked this session, nor one with a hostname or a stored answer (this session's, the cache file's or a save's).
Called by: queue_address
Calls: hostmap_get, skipped_address, find_entry, reverse_answer_find
queue_address
static void queue_address(netotter_t *netotter, int1 v6, const uint8_t *ip)
src/analysis/reverse_queue.c:70 · static · both builds
Called by: reverse_queue_packet
Calls: ip_len (reverse_queue.c), needs_lookup
Library and system calls: malloc, memcpy, memset
reverse_queue_packet
void reverse_queue_packet(netotter_t *netotter, fpacket_t *packet)
src/analysis/reverse_queue.c:89 · non-static · both builds
Queues a PTR lookup for each address of the packet that has no hostname yet and was never asked (online mode only; multicast, broadcast, loopback and unspecified addresses are skipped). Nothing is sent here: reverse_tick does it. (from
includes/reverse.h)
Called by: reverse_queue_lookups
Calls: queue_address
reverse_queue_lookups
void reverse_queue_lookups(netotter_t *netotter, fpacket_t *packet)
src/analysis/reverse_queue.c:104 · non-static · both builds
In the analysis view and online mode, queues reverse DNS lookups for the addresses with no hostname: those of packet, or of every packet the list shows when packet is NULL. They're sent at the next ticks, their names show at the next 'l' / 'i'.
Called by: list_command, info_command
Calls: filters_match, reverse_queue_packet
src/analysis/reverse_store.c
The answers of NetOtter's own reverse DNS lookups, kept so an address is never asked twice: in memory for the session, in the cache file across sessions, in .nto files with their packets
ip_len in reverse_store
static int ip_len(int1 v6)
src/analysis/reverse_store.c:19 · static · both builds
Called by: reverse_answer_find, reverse_record_put, reverse_record_get, reverse_answer_add
answer_bucket
static uint32_t answer_bucket(int1 v6, const uint8_t *ip)
src/analysis/reverse_store.c:24 · static · both builds
Called by: reverse_answer_find, reverse_answer_add
Calls: ip_fnv1a
reverse_answer_find
reverse_answer_t *reverse_answer_find(reverse_t *rv, int1 v6, const uint8_t *ip)
src/analysis/reverse_store.c:29 · non-static · both builds
The answer stored for ip, NULL if there's none (from
includes/reverse.h)
Called by: needs_lookup, reverse_answer_add, mark_address
Calls: ip_len (reverse_store.c), answer_bucket
Library and system calls: memcmp
reverse_record_put
int reverse_record_put(uint8_t *buf, const reverse_answer_t *answer)
src/analysis/reverse_store.c:40 · non-static · both builds
One answer as it's saved, in the cache file and in .nto files: u8 v6 flag, 4 or 16 address bytes, u8 name length (0: no name), name. Writes it to buf (REVERSE_RECORD_MAX bytes) and returns its length. (from
includes/reverse.h)
Called by: cache_append, put_answers
Calls: ip_len (reverse_store.c), my_strlen
Library and system calls: memcpy
reverse_record_get
int reverse_record_get(const uint8_t *data, uint32_t len, int1 *v6, uint8_t ip[16], char name[HOST_NAME_MAX_LEN + 1])
src/analysis/reverse_store.c:54 · non-static · both builds
Reads one from data (len bytes): name gets "" for no name. Returns its length, 0 if it's cut short, -1 if it's malformed (the name must be printable ASCII, it goes to the terminal). (from
includes/reverse.h)
Called by: cache_parse, load_answers, load_hosts
Calls: ip_len (reverse_store.c)
Library and system calls: memcpy, memset
cache_disable
static void cache_disable(reverse_t *rv, const char *why, const char *effect)
src/analysis/reverse_store.c:85 · static · both builds
Stops using the cache file for the session, saying why and what it means (CACHE_UNREAD / CACHE_UNWRITTEN). The answers already loaded stay in memory.
Called by: cache_create, cache_append, cache_parse, reverse_cache_load
Calls: my_putstr
Library and system calls: close
write_all
static int write_all(int fd, const uint8_t *data, int len)
src/analysis/reverse_store.c:96 · static · both builds
Called by: cache_append
Library and system calls: write
cache_create
static int cache_create(reverse_t *rv)
src/analysis/reverse_store.c:113 · static · both builds
Opens the cache file to append to it, creating it and its directory (only the first answer of a session gets here when it didn't exist). 0 when it's open.
Called by: cache_append
Calls: cache_disable, my_putstr, cache_file_path, cache_file_path
Library and system calls: _errno, open, strerror
cache_append
static void cache_append(reverse_t *rv, const reverse_answer_t *answer)
src/analysis/reverse_store.c:135 · static · both builds
Appends a new answer to the cache file, after the header when the file is new. A failed write disables the cache file for the session.
Called by: reverse_answer_add
Calls: reverse_record_put, cache_disable, write_all, cache_create
Library and system calls: fstat, write
reverse_answer_add
int reverse_answer_add(netotter_t *netotter, int1 v6, const uint8_t *ip, const char *name, enum REVERSE_ORIGIN origin)
src/analysis/reverse_store.c:155 · non-static · both builds
Stores the answer for ip (name NULL: the resolver said there's no name) unless the address has one already: one answer per address. Its name goes to the host map unless the address has one (a name learned passively stays). RA_LOOKUP answers are also appended to the cache file. 0 if stored, 1 if the address already had an answer, -1 if it can't be stored (store full, out of memory). (from
includes/reverse.h)
Called by: handle_answer, cache_parse, load_answers
Calls: hostmap_set, hostmap_get, ip_len (reverse_store.c), answer_bucket, reverse_answer_find, cache_append, my_strlen
Library and system calls: free, malloc, memcpy, memset
cache_read
static uint8_t *cache_read(int fd, uint32_t *len, int1 *at_end)
src/analysis/reverse_store.c:192 · static · both builds
The start of the cache file (at most CACHE_READ_MAX bytes), allocated. *at_end is set when that's the whole file. NULL on error.
Called by: reverse_cache_load
Library and system calls: free, fstat, malloc, read
print_loaded
static void print_loaded(reverse_t *rv, uint32_t loaded, uint32_t dups)
src/analysis/reverse_store.c:218 · static · both builds
Called by: cache_parse
Calls: my_putunbr, my_putstr
cache_parse
static void cache_parse(netotter_t *netotter, const uint8_t *data, uint32_t len, int1 at_end)
src/analysis/reverse_store.c:236 · static · both builds
The records after the header. A record cut short at the end of the file is an interrupted write: dropped, so the next ones append after a whole record. Anything malformed disables the file.
Called by: reverse_cache_load
Calls: reverse_record_get, cache_disable, reverse_answer_add, print_loaded
Library and system calls: ftruncate
reverse_cache_load
void reverse_cache_load(netotter_t *netotter)
src/analysis/reverse_store.c:272 · non-static · both builds
At startup: loads the answers of earlier sessions from the cache file (cache_file_path) and prints how many. Nothing is created here: the file is only created when the first answer arrives. (from
includes/reverse.h)
Called by: netotter
Calls: cache_disable, cache_read, cache_parse, cache_file_path, cache_file_path
Library and system calls: _errno, free, ftruncate, memcmp, open, strerror
print_origin
static uint32_t print_origin(reverse_t *rv, enum REVERSE_ORIGIN origin, char *where, int1 all, int output_buffer)
src/analysis/reverse_store.c:312 · static · both builds
The answers of one origin under a title naming where they come from: those no 'd' has shown yet (marked shown), or with all every one of them (marks unchanged). How many it printed.
Called by: reverse_store_print
Calls: print_ipv4_raw, print_ipv6_raw, my_putstr
reverse_store_print
uint32_t reverse_store_print(reverse_t *rv, int1 all, int output_buffer)
src/analysis/reverse_store.c:339 · non-static · both builds
The answers loaded from the cache file, then those from a -I file ("address -> name", or "-> no name"), each printed by the first call only; this session's lookups are in the log instead. With all ('D'): every stored answer, this session's too, whatever was printed before. How many it printed. (from
includes/reverse.h)
Called by: reverse_log_print, reverse_log_print_all
Calls: print_origin
reverse_store_free
void reverse_store_free(reverse_t *rv)
src/analysis/reverse_store.c:352 · non-static · both builds
Frees the answers and closes the cache file (called by reverse_free) (from
includes/reverse.h)
Called by: reverse_free
Library and system calls: close, free
src/analysis/view.c
Where the 'l' and 'i' output goes: straight to stdout in the classic view, through the renamings in the analysis view
view_begin
int view_begin(netotter_t *netotter)
src/analysis/view.c:14 · non-static · both builds
Analysis view (src/analysis/view.c): where the 'l' / 'i' output goes. view_begin returns 1 (stdout) in the classic view or without renaming, OUT_MEMORY otherwise; view_end then prints that output renamed. In the analysis view, ports are also shown by name between the two. (from
includes/netotter.h)
Called by: list_command, info_command, stats_command, warnings_command
Calls: display_port_names, display_hosts
view_end
void view_end(netotter_t *netotter, int output_buffer)
src/analysis/view.c:23 · non-static · both builds
Called by: list_command, info_command, stats_command, warnings_command
Calls: display_port_names, display_hosts, renames_write, my_out_take
Library and system calls: free
User guide
- Overview
- Installation
- Getting started
- Command-line options
- Interactive commands
- Display filters
- Analysis view
- Reverse DNS and privacy
- Anomaly detection
- Save files
- Memory and limits
- Troubleshooting
Developer documentation
- Overview
- Building
- Architecture
- OS backends
- Packet parsing
- Packet storage
- Save format
- Hostname learning
- Reverse DNS internals
- Filters and analysis internals
- Anomaly lab
- Coding conventions
- Function explorer
Learning