Get DNS name with IP address

[rgarci6]

Hi,

Using a firewall appliance.  In it, I can see the source and destination IP addresses.  Is there a way to the DNS name of destination site instead of only the IP addresses?

I am being asked for a report to show where a particular computer is connecting to and can see the IP address to site but need to know the name of the site.

Anyway to get this information from the appliance?

Thanks for any info you can share.

New to CP and this site.

[Chris_Atkinson]

Reverse DNS resolution for an IP won't necessarily correlate to anything meaningful. For more detail you really need to have features such as the following activated:

- URL Filtering

- Application Control

- HTTPS / SSL Inspection

[Bob_Zimmerman]

Even when it's working, a reverse DNS lookup today can't tell you what an IP was yesterday. Anybody with a stolen credit card can get an IP from Amazon, Google, Microsoft, or other companies, and it will be allocated to somebody else tomorrow. That makes it useless for forensic investigations, for example.

For HTTP(S) traffic, whether on 80/443 or arbitrary ports, URL Filtering tries to log the URL the client requested. For HTTPS in particular, you would need to have HTTPS inspection enabled, which requires distributing a private certificate authority to clients and adding it to their x509 anchors. This can provide solid information in the future, but can't be done retrospectively: if it wasn't enabled at the time, the firewall may not have been able to log the information you want.

For arbitrary protocols (e.g., SSH, which is very unlike HTTP), your best bet would be to force clients to use a particular DNS server, then log DNS requests and responses on that server. Again, good for the future, but can't be done retrospectively.