# Display the DNS of the visiting IP **URL:** \ **Category:** SIEM\ **Created:** [May 5, 2021, 11:12am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174 "2021-05-05T11:12:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [May 5, 2021, 11:12am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/1 "2021-05-05T11:12:54Z")
Hi, In SEIM I can see the DNS requests coming out from my machine. Like when I'm visiting google it is logged here in SIEM --\> Network --\> DNS ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16921fd14af9c129587c5e89a6891871b162a581.png) I need the contrary, How can I see the DNS of the IP's visiting my machine? Like if some service trying to access my machine? Thank you all! ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [May 6, 2021, 5:28am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/2 "2021-05-06T05:28:50Z")
Are you looking for reverse dns lookups? If so there is a logstash processor that can do that but it will slow down ingest. ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [May 10, 2021, 10:24am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/3 "2021-05-10T10:24:19Z")
Thanks @legoguy1000 Yes it should be reverse dns lookup, but can't this be done via packetbeat.yml ? Or is there any other solution other than logstash config? Suppose someone is ingesting directly to elasticsearch without logstash, wouldn't be there any solution for him? Regards, ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [May 10, 2021, 11:00am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/4 "2021-05-10T11:00:53Z")
I'm not tracking a way for packetbeat to do that natively. It could potentially decrease performance drastically. ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [May 11, 2021, 10:10am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/5 "2021-05-11T10:10:58Z")
Hi @legoguy1000 1- Do you have an example of of setting this up? 2- Is it going to add a new field in kibana or it will replace one? Regards, ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [May 11, 2021, 10:32am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/6 "2021-05-11T10:32:43Z")
As I said, there is no Beats processor to do a dns lookup of and ip or fqdn. There is a logstash plugin, [Dns filter plugin | Logstash Reference [7.12] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html), that can do it but once again it can cause significant performance impacts since it has to wait for the dbs query response. ---
**Author:** ![ethical20](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ethical20/32/68123_2.png) [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Post date:** [May 11, 2021, 10:38am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/7 "2021-05-11T10:38:40Z")
Many thanks will give a shot and test. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 8, 2021, 10:39am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174/8 "2021-06-08T10:39:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.