iwla/plugins/post_analysis/reverse_dns.py

import socket

from iwla import IWLA
from iplugin import IPlugin

class IWLAPostAnalysisReverseDNS(IPlugin):
    def __init__(self, iwla):
        super(IWLAPostAnalysisReverseDNS, self).__init__(iwla)
        self.API_VERSION = 1

    def load(self):
        timeout = self.iwla.getConfValue('reverse_dns_timeout', 0.5)
        socket.setdefaulttimeout(timeout)
        return True
        
    def hook(self, iwla):
        hits = iwla.getValidVisitors()
        for (k, hit) in hits.items():
            if hit.get('dns_analysed', False): continue
            try:
                name, _, _ = socket.gethostbyaddr(k)
                hit['remote_addr'] = name
            except:
                pass
            finally:
                hit['dns_analysed'] = True