Skip to main content

Hosts import & export

· 3 min read
Thibaut Raballand
Creator of Spider

Hosts management has received an upgrade for the best:
It is now easy to list all hosts captured by a Whisperer, to name unknown hosts, and then export the list to import on an upload Whisperer.

Origin​

This item was part of the backlog with a low priority, but its priority increased to the top because the feature is very useful to complete the user training exercices.

New 'Hosts' tab​

A new 'Hosts' tab has been added to Whisperer details. It lists the hosts captured by the selected whisperer(s).

Hosts tab

It is available when opening whisperer details from the menu or the top level status.
When many whisperers are selected, it shows all hosts from all selected whisperers.

Rename hosts​

When the details are opened on selected Whisperers, you may then rename hosts, as you would do from the grid ou the host and communications details.

This way is much easier, as:

  • it is easy to see the list of hosts to name and their IP,
  • clicking on the grid opens the Host detail view of the related host,
  • you may also filter to view only this host communications from the host tooltip...
    • Maybe I should make the latter even easier.

Export format​

You may export the hosts list using the top level button. The export format is the following:

{
  "@type": "HostsDownload",
  "user": "your.user@floocus.com",
  "totalItems": 12,
  "downloadDate": "2022-08-16T10:44:52.907Z",
  "items": [
    {
      "@id": "jqZFiq2SSvyNaYpc5LS2gw.10.1.22.146.2022-07-17T16:07:58.442Z",
      "whisperer": "jqZFiq2SSvyNaYpc5LS2gw",
      "ip": "10.1.22.146",
      "type": "SERVER", // or CLIENT or BOTH
      "lastSeen": "2022-07-17T16:08:33.751Z",
      "lastUpdate": "2022-07-17T16:07:58.442Z",
      "firstSeen": "2022-07-17T16:07:58.442Z",
      "customName": "tariffs",
      "hostname": "tariffs.dev.example.com"
    },
    ...
  ]
}

Each item is a host as stored in Spider, with:

  • ip - IP address
  • type - Type of hosts: client, server or both
  • firstSeen - First time the host was seen in a capture
  • lastSeen - Last time the host was seen in a capture
  • lastUpdate - Last time the host item has been updated
  • hostname - FQDN of the host, as resolved in the DNS
  • customName - A custom name, defined by a user, or compacted from the FQDN base on a regular expression

Import hosts to an Upload Whisperer​

The exported host list may be imported back in Spider, to a Upload whisperer using the same upload button as to upload PCAP or JSON communications items.

Upload PopIn

The injected hosts are merged with the existed ones, and the names updated.

It allows to easily export and name hosts.