Reverse-resolve an IP
arkime_reverse_dnsRead-only
Resolve any IPv4/IPv6 address to its current PTR hostname using Arkime's resolver. Identify external hosts in network traffic with live DNS names, complementing captured session data.
Instructions
Resolve one IP address to its PTR hostname, using Arkime's resolver.
Use this to put a name on an external address a session talked to —
`idf-rtr.example.com` says more than `198.51.100.1`. For internal
assets, malcolm_netbox_lookup gives a far richer answer than a PTR
record.
This is a live outbound PTR query leaving the Malcolm deployment now,
not a read of the capture: measured on Malcolm v26.07.1 it answered
`dns.google` for 8.8.8.8, a name appearing nowhere in the 58,144
sessions this capture holds for that address. So it reports DNS today
rather than the traffic, and resolving an address an adversary controls
can signal your interest to them. For the names the capture itself
observed, search event.dataset=dns with malcolm_search instead. Return
fields, and what resolved:false means, are in the output schema.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | One IPv4 or IPv6 address to reverse-resolve, e.g. "8.8.8.8". Not a hostname, not a CIDR range. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |