InternetOfficer.com

Basically just looking to convert 123.45.6.78 to customer.att.com or something.vaguely.meaningful.org

From the config file notes, this forum, and web searches, I'm only seeing 4 things related to IP's or reverse DNS that might address this:

DNSLookup=1 – this gets about half of the addresses I'd expect it to. I realize it won't get internal or a lot of ISP's or government offices, but I thought if "ping -a" gives a clear answer, then this could also. Needless to say, it also takes a long time, just like the config notes say it will.

-dnslookup on the logresolvemerge.pl – this doesn't seem to affect the IP's.

IPv6 plugin – no effect.

Geo::IP/Geo::IPfree – brings in countries as mentioned, but nothing else.

In particular, I expected DNSLookup and IPv6 to work, and DNSLookup seems like it did to a limited extent, but there's clearly something I don't understand with what they're meant to do.

If you could point me in the direction of a good doc on these or tell me I'm an idiot who should have just used (fill in the blank), I'd appreciate it.

I don't think false/invalid answers are an issue. If they're going to that much trouble to mess with my logs, more power to them. I was more concerned about the long list of no answer's.

It's my understanding that "ping -a" also asks like what you described, which is why I was confused at seeing an answer doing it manually vs. not seeing an answer on the report.

I'll probably play with the hostinfo plugin next. It may not be user friendly, but most users aren't friendly either, so it's all fair. ;)

It's on the other side of a firewall from the user network, so there's only one internal IP to worry about, that of the firewall. There are others that belong to state government offices that hit our site frequently that I'm not surprised at not seeing, since most don't respond when I try looking them up either. I was mostly confused at the lack of common ones that do respond, like ATT ISP users.

Thank you for the response, I think the center of my answer is just that hostinfo is the last thing I haven't tried for general lookup.