search

USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Request: Specify output directory in rip-http and network address resolution #15

Closed farewell-ladmin closed 9 years ago

farewell-ladmin commented 9 years ago

When using the rip-http module with a pcap file I noticed that it put all the ripped files in the install directory. There only seems to be input controls for rip-http and I'm not seeing an -o or -tmpdir option like in some of the other modules.

Is this something that exists already? If so what is the option to enable it and if not can it be added as an option of rip-http.

Also I have been unable to find an option to enable resolving network addresses to hostnames. I have it set in tcpdump and Wireshark to resolve and find it helpful tracking down issues. In my digging around I have been unable to find the option to enable this. Does this option exist (or is set to exist in Dshell) and if it does how does one go about enabling it?

I would find a flag to enable network address resolution quite helpful. Loving the project so far.

wglodek commented 9 years ago

@pr0digal The option to resolve network addresses to host names does not exist. At this time there is no plan to implement network address resolution. Dshell was designed to be completely passive (i.e. does not make external network connections).

farewell-ladmin commented 9 years ago

@wglodek Thanks for the update. Just thought I'd ask.

And I see there was a change for rip-http, many thanks.