Network hosts

The bottom portion of the Overview page features interesting details about the network hosts our machine is exchanging data with.

[pic]

A bunch of information can be obtained by carefully examining this section, and this is the reason why I think it's necessary to dedicate a whole Wiki page to this aspect.

Let's start by defining what Sniffnet qualifies as a network host.
A network host is intended as an entity participating in a data exchange with the monitored machine; such an entity is identified by 3 different parameters:

• geographical location
• domain name
• Autonomous System Name

These 3 parameters, in the order, are displayed for each of the hosts in this section, and are better described in the following.

Geographical location

The geolocation of an host has country-wide granularity and is represented by the corresponding flag.
Hovering over the flag will display the country code, in case you are having troubles to recognise it.

The geographical location is determined based on the host IP address, performing lookups against an MMDB database natively integrated in Sniffnet.

Note

The MMDB (MaxMind database) format has been developed especially for IP lookups.
It is optimized to perform lookups on data indexed by IP network ranges quickly and efficiently.
It permits the best performance on IP lookups, and it's suitable for use in a production environment.

This application includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com/