Network

Sometimes, a strange IP will show up in logs, and you will need to find out more information, or there can be a domain name that you need to geolocate based on an IP address. These examples demonstrate gathering information about hosts. Packet capturing is also an integral part of network forensic investigations, but there is so much to say about packet capturing, so Chapter 5, Packet Capturing and Injection dedicated just to packet capturing and injection.

Looking up a hostname from an IP address

This program will take an IP address and figure out what the hostnames are. The net.parseIP() function is used to validate the IP address provided, and net.LookupAddr() does the real work of figuring out what the hostname is.

By default, the pure Go resolver is used. The resolver can be overridden by setting the netdns value of the GODEBUG environment variable. Set the value of GODEBUG to go or cgo. You can do this in Linux with the following shell commands:

export GODEBUG=netdns=go # force...