Network hosts

The bottom portion of the Overview page features interesting details about the network hosts our machine is exchanging data with.

[pic]

A bunch of information can be obtained by carefully examining this section, and this is the reason why I think it's necessary to dedicate a whole Wiki page to this aspect.

Let's start by defining what Sniffnet qualifies as a network host.
A network host is intended as an entity participating in a data exchange with the monitored machine; such an entity is identified by 3 different parameters:

• geographical location
• domain name
• Autonomous System Name

These 3 parameters, in the order, are displayed for each of the hosts in this section, and are better described in the following.

Geographical location

The geolocation of an host has country-wide granularity and is represented by the corresponding flag.
Hovering over the flag will display the country code, in case you are having troubles to recognise it.

The geographical location is based on the host IP address, and it's retrieved performing a lookup against an MMDB database natively integrated in Sniffnet.

Note

The MMDB (MaxMind database) format has been developed especially for IP lookups.
It is optimized to perform lookups on data indexed by IP network ranges quickly and efficiently.
It permits the best performance on IP lookups, and it's suitable for use in a production environment.

This application includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com/

This file format potentially allows Sniffnet to execute hundreds of different IP lookups in a matter of a few milliseconds.

Domain name

Put in simple terms, this parameter can identify:

• the resource provided by an host through the Internet (such as a website or an email service) in case of a server host
• the name of the host itself in case of an individual host computer — this is typical for devices in the same local network we are monitoring