Implemented (disabled by default) DNS host cache. You can set the cache size as follows:

ndpiReader --cfg=dpi.address_cache_size,1000 -i <pcap>.pcap

In the above example the cache has up to 1000 entries.

In jcase ndpiReader exports data in JSON, the cache hostname (if found) is exported in the field server_hostname

1 files changed, 1 insertions, 0 deletions

diff --git a/example/reader_util.h b/example/reader_util.h
index ef15053cd..956bb1955 100644
--- a/example/reader_util.h
+++ b/example/reader_util.h
@@ -259,6 +259,7 @@ typedef struct ndpi_flow_info {
   ndpi_serializer ndpi_flow_serializer;
 
   char host_server_name[80]; /* Hostname/SNI */
+  char *server_hostname;
   char *bittorent_hash;
   char *dhcp_fingerprint;
   char *dhcp_class_ident;