how to detect what hostname a client is using to connect to server

shail49 · 10-09-2007, 03:52 PM

Is there a way to find out what hostname (not IP) clients are using to connect to a server? For example: client A is telnetting to Server B, using hostname C.domain.com. (B and C resolve to the same IP). Can we, on the server B find out that Client A used C.domain.com to connect?

rsashok · 10-09-2007, 04:04 PM

I'd try to capture traffic with Ethreal or 'tcpdump', and then look inside relevant packets for the name.

shail49 · 10-10-2007, 07:15 AM

Thank you for the response. I already tried tcpdump, but it looks like the name resolution happens on the server side. For example, let's say the client uses C.domain.com to connect to server B.domain.com. tcpdump still prints the destination server name as B.domain.com not C.domain.com. Seems like the resolution is done on the server side with tcpdump. Are there any other specific fields I can take a look at?

dumbsheep · 10-12-2007, 05:25 PM

try etherape