=pod

=head1 NAME

B<rwresolve> - Convert IP addresses in delimited text to hostnames

=head1 SYNOPSIS

  resolve [--ip-fields=FIELDS] [--delimiter=C]

=head1 DESCRIPTION

B<rwresolve> is a pipe-lining application to resolve the IP addresses
that appear in delimited textual input and replace the IP address with
its hostname.

Because B<rwresolve> must do a DNS query for every IP address, it is
B<extremely> slow.  B<rwresolve> works best on very limited data sets.

It is designed specifically to deal with the output of B<rwcut(1)>,
though it will work with other SiLK tools that produce delimited text.
Its job is to read the standard input and convert the specified fields
(default fields 1 and 2) separated by a delimiter (default 'B<|>')
from a dotted-decimal IP address to a hostname.  The IP fields are
specified via the B<--ip-fields>=I<FIELDS> option.  The B<--delimiter>
option can be used to specify an alternate delimiter.

=head1 OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an
exact match for an option.  A parameter to an option may be specified
as B<--arg>=I<param> or S<B<--arg> I<param>>, though the first form is
required for options that take optional parameters.

=over 4

=item B<--ip-fields>=I<FIELDS>

Column number(s) of the input that should be considered IP numbers.
Column numbers start from 1.  If not specified, the default is 1,2.

=item B<--delimiter>=I<C>

The character that separates the columns of the input.  Default is
'B<|>'.

=back

=head1 EXAMPLE

Suppose you have found some interesting data, and you want to look up
the hostnames of the sources.  In addition to the default fields of
1-12 produced by B<rwcut>, you also want to append to each row the
hostname of the source IP:

    rwcut --fields=1-12,1 interesting.rwf | \
        rwresolve --ip-field=13

=head1 SEE ALSO

B<rwcut(1)>

=head1 BUGS

Because B<rwresolve> must do a DNS query for every IP address, it is
B<extremely> slow.

The output from B<rwresolve> is rarely columnar because hostnames can
be very long.  You may want to consider putting the resolved hostnames
in the final column of output.

=cut

$SiLK: rwresolve.pod 6919 2007-04-16 20:02:48Z mthomas $

Local Variables:
mode:text
indent-tabs-mode:nil
End: