DocumentationNames
The Names tab brings captured name evidence into one table. Opening it reads retained facts from the current Triage generation; it does not rescan the capture or require deep Infrastructure discovery.
Names and mappings
- Resolved: a captured name has an address association. DNS answers and DHCP/DHCPv6 assignments can label IPv4 or IPv6 endpoints.
- Observed only: a name appears in a query, alias, or service reference without an address mapping. A query does not name the querying device or resolver.
- Unresolved: an observed endpoint has no available name mapping.
HTTP authorities, TLS SNI, and certificate identities remain connection-scoped. They must not rename unrelated connections sharing a CDN or proxy IP. An ECH extension may be a GREASE placeholder. Its presence does not prove ECH negotiation; the visible SNI may be an outer/cover name and is not treated as proof of the hidden destination.
Source coverage
| Source | Current retained Names path |
|---|---|
| DNS, mDNS, LLMNR, NBNS | Queries, address associations, aliases, PTR and service targets retained by the identity reducer; DNS record owners and NS/MX/SOA/DNAME/RRSIG/NSEC targets remain observed-only |
| DHCP/DHCPv6 | Retained hostname assignments, including IPv6 addresses |
| CDP/LLDP | Retained device/system names and endpoint associations |
| TLS and certificates | Observable SNI and retained certificate SAN identities |
| HTTP/1, HTTP/2, HTTP/3 | Decoded Host or authority observations |
| External reverse DNS | Separately requested enrichment, where available; never automatic |
| Embedded PCAPNG name records, MAC inventory, SMB, Kerberos, SIP/SDP, mail, AMQP, XMPP, TDS | Separate metadata or legacy extraction paths; not guaranteed by the compact Names projection |
The compact reducers do not interpret arbitrary TXT content as host names. They retain the record's owner name and type. Encrypted application names require decoded evidence; Names does not decrypt traffic.
Evidence and limits
Search by name, source, or address. View packets pivots to matching evidence, and First observed packet opens a retained original-frame anchor. The table retains protocol source and observed counts when available.
The virtualized table shows the complete retained projection when it fits within 10,000 entries and 2 MiB, examining at most 65,536 rows per identity family. Within the examined entries, distinct names appear before additional mappings for the same name. A partial-evidence notice identifies unavailable sources or capacity limits; an empty partial result does not establish that names are absent. Use Query to inspect the retained datasets beyond the preview. Expired query data must be regenerated before it can be read.
Browse all retained names and Browse HTTP and TLS identities open the corresponding dataset with server-side search, pagination and CSV export. These read retained facts without rescanning the PCAP. Source processing limits still apply and are reported separately; pagination cannot recover evidence that was never retained. Captures processed before record-owner extraction was added need Triage regeneration to include those observations.
Use Infrastructure for endpoint relationships and role modeling beyond names.
TLS handshake filters
In the TLS overview, combine search and assessment with Key exchange and
ECH observation filters. Search includes selected and offered group names,
for example X25519MLKEM768.
- Hybrid PQ negotiated requires retained server-selection evidence.
- Classical selected includes clients that offered PQ but selected a classical group.
- PQ offered; selection unseen and Selection unknown preserve missing evidence.
- ECH extension observed includes GREASE; acceptance is unconfirmed. Missing ECH metadata stays unknown, separate from extension not observed.
PQ describes key exchange, not certificate authentication or the quantum safety of the entire connection. Filters operate on retained handshake rows and make no additional packet scans. Counts describe that retained inventory, not an unseen capture-wide total. Older TLS results can lack ECH observations; use the existing TLS analysis rebuild action to regenerate metadata when needed.