hf, ef, nf, pf - address to name filters
hf [-1abcdilN] [-f format] [-R qps] [-t secs]
[file ...]
hf -x [file ...]
ef [-d] [file ...]
nf [-di] [file ...]
pf [-d] [file ...]
These filters reads the named files (or from stdin if there are none) and
replace occurrences of a particular kind of address to the corresponding name:
hf - converts raw internet addresses to hostnames.
ef - converts ethernet addresses to hostnames.
nf - converts network addresses to names.
pf - converts square bracketed port numbers to names.
Options common to all programs:
- -d
- Print some debugging infomation to stderr before exiting. When used more
than once, also dump the internal hash table.
Options specific to hf:
- -1
- Attempt to convert only the first address on a line.
- -a
- Use asynchronous DNS lookups.
- -b
- Prints both the hostname and the ip address (the latter in parentheses).
This is a shortcut for -f "%h(%i)".
- -c
- Checks the names against ip addresses; that is, the hostname the address
resolves to must resolve back to the address or else the address is not
converted to a hostname.
- -f
- Specify a format string containing escapes to be used to create the
replacement text. The escapes are as follows:
%h - hostname (%D, %N, %l or
even %i)
%D - local domain truncated hostname
%N - domain truncated hostname
%l - long hostname (FQDN)
%i - ip address
%% - %
Unrecognized escapes expand to the character without the
percent. It's acceptable to use specific escapes more than once. Specifying an
empty format resets it to the default ("%h").
- -i
- Force converted names to be all lowercase.
- -l
- By default, hf strips the domain part of hostnames in the local
domain. The -l flag suppresses this stripping.
- -N
- Strips the entire domain of all hostnames.
- -R
- Specify a maximum rate in queries per second. By default queries are
limited to 1000/sec. This can be disabled by specifying a rate of 0.
- -t
- Specify a timeout (in seconds) for name and address lookups. By default,
timeouts are left up to the resolver routines.
- -x
- Instead of replacing ip addresses with names, just output the raw ip
addresses, one per line. When the flag is used more than once, the cidr
width is included with the ip address in the output. For example
203.0.113.0/24. No other flags are allowed (or would even make
sense).
Options specific to nf:
- -i
- Force converted names to be all lowercase.
- -b
- Prints both the hostname and the ip address (the latter in
parentheses).
- -p
- Pad network addresses to four octets.
gethostbyaddr(3), ether_aton(3), getnetbyaddr(3), getservbyport(3)
If a port number has different tcp and udp names, pf will favor the tcp
name.