Reverse DNS and privacy

NetOtter is a passive tool, with one exception: reverse DNS lookups. They are the only packets it ever sends. This page says when it sends them, how to see every one of them, and how to turn them off.

What is sent, and when

A reverse DNS lookup asks a DNS server "which name belongs to this address?" (a PTR query; the DNS page shows one byte by byte).

NetOtter sends one only when all of these hold:

• It is in online mode, the default. -N starts it offline, and N switches the mode.
• You are in the analysis view (a) and run l or i. Only the addresses those commands show are looked up.
• The address has no name yet: none learned from the traffic, and no answer stored from an earlier lookup.
• The address is worth asking about: multicast, broadcast, loopback and unspecified addresses are skipped.
• It was never asked before. Every definite answer is kept on disk, so an address is asked once, ever (see below).

Your machine's own addresses aren't skipped: they're looked up like any other, even though the analysis view shows them as me.

The queries go to your system's DNS server: the first nameserver of /etc/resolv.conf on Linux, the first DNS server of your network settings on Windows (IPv4 only). Nothing is sent in the CLI mode, nor in the classic view.

Seeing them

The first lookup announces where the queries go and where the answers are kept:

Reverse DNS lookups go to 192.0.2.2 (N to go offline)
Their answers are kept in /home/you/.cache/netotter/reverse_dns.cache, so no address is asked twice

Every tick that sends queries says so:

Reverse DNS: 2 queries sent to 192.0.2.2 (d to see them)

d then shows each query and each answer, with every byte:

Reverse DNS query #13505 for 192.0.2.1 -> 192.0.2.2:53 (40 bytes)
  0000  34 c1 01 00 00 01 00 00  00 00 00 00 01 31 01 32  |4............1.2|
  0010  01 30 03 31 39 32 07 69  6e 2d 61 64 64 72 04 61  |.0.192.in-addr.a|
  0020  72 70 61 00 00 0c 00 01                           |rpa.....|
Reverse DNS answer #13505: client.example.com (72 bytes)
  0000  34 c1 81 80 00 01 00 01  00 00 00 00 01 31 01 32  |4............1.2|
  0010  01 30 03 31 39 32 07 69  6e 2d 61 64 64 72 04 61  |.0.192.in-addr.a|
  0020  72 70 61 00 00 0c 00 01  c0 0c 00 0c 00 01 00 00  |rpa.............|
  0030  0e 10 00 14 06 63 6c 69  65 6e 74 07 65 78 61 6d  |.....client.exam|
  0040  70 6c 65 03 63 6f 6d 00                           |ple.com.|
Reverse DNS answer #10222: no name (90 bytes)
  ...

d shows what happened since the previous d, and D shows everything again (the last 10,000 events). Queries left unanswered for 5 seconds are dropped, and d reports them too.

Turning it off

How	Effect
netotter -N ...	Starts offline: nothing is sent, no socket is even opened.
N (interactive)	Switches online / offline. Going offline closes the socket and drops the lookups not answered yet.

Offline, stored answers still name addresses: those of earlier sessions (from the cache file) and those that came with a loaded .nto file.

The answer cache

Every definite answer, a name or "no name", is kept in a cache file so that no address is ever asked twice, even across sessions:

System	File
Linux	$XDG_CACHE_HOME/netotter/reverse_dns.cache, or ~/.cache/netotter/reverse_dns.cache
Windows	%LOCALAPPDATA%\NetOtter\reverse_dns.cache

• Created only when needed: the file and its folder only appear with the first answer, readable by you only.
• Loaded at startup: NetOtter says how many answers it loaded (Reverse DNS cache: 15 answers loaded from ...).
• Never expires: answers have no expiry date in the cache (DNS's time-to-live values are ignored).
• Inconclusive replies aren't kept: a timeout, or a server error, gets asked again in a later session.
• Resetting: delete the file to start over.

If the file is damaged, NetOtter says why on stderr. Depending on the damage, it trims a half-written last record, or keeps the answers before the damage and stops adding to the file, or leaves a file it doesn't recognize untouched.

Names in shared captures

A .nto file carries the names that belong to its packets' addresses: the lookup answers and the names learned from the traffic. It never carries the whole cache. That way, sharing a capture doesn't reveal every host you looked up in other sessions.