Netgate SG-1000 microFirewall

Author Topic: Where does ntopng get hostnames from?  (Read 161 times)

0 Members and 1 Guest are viewing this topic.

Offline wkearney99

  • Jr. Member
  • **
  • Posts: 26
  • Karma: +0/-0
    • View Profile
Where does ntopng get hostnames from?
« on: February 04, 2018, 03:48:14 pm »
In looking at the :3000/lua/hosts_stats.lua?mode=local page (hosts, filtered by local only) I'm seeing a bunch of entries in the 'Name' column that don't correspond to the actual entries for those IP addresses.  I'm seeing text that doesn't appear in the /etc/hosts or the DNS. 

I can run nslookup on the pfsense machine and it does not return the name ntopng is showing.  I can also look up the IP via 'genent hosts x.x.x.x' and it likewise does not bring up the Name showing in ntopng.

I'm running ntopng Community Edition v.3.2.180119 on a 2.4.3-DEVELOPMENT amd64 pfSense install. 

I've got pfsense set up for DHCP and DNS service to the local network.  Just about everything has a static lease.  They're all showing up reliably and consistently using name lookups from other hosts on the local network.  So the DHCP/DNS parts of the pfsense seem to be configured properly/effectively.

Where else might ntopng be looking for this Name info?  And how can I either stop it from doing that, and using either /etc/hosts or the local DNS server?  Is there some database of the hostnames it's keeping?  Can I purge that list and have it re-do it's lookups?