# Specify domains in \`/etc/elastiflow/app/ipport.yml\`

**URL:** <https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266>\
**Category:** ElastiFlow Community\
**Created:** [March 16, 2025, 9:07am UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266 "2025-03-16T09:07:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yaslam](https://avatars.discourse-cdn.com/v4/letter/y/34f0e0/32.png) [@yaslam](https://forum.elastiflow.com/u/yaslam)\
**Post date:** [March 16, 2025, 9:07am UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266/1 "2025-03-16T09:07:11Z")

</div>

Hi everyone. I am wondering if instead of specifying IPs and Ports in the above file, whether it is possible to specify domains. It would make it easier to add rules for applications.

Thanks

---

<div class="post-metadata">

**Author:** ![yaslam](https://avatars.discourse-cdn.com/v4/letter/y/34f0e0/32.png) [@yaslam](https://forum.elastiflow.com/u/yaslam)\
**Post date:** [March 16, 2025, 9:07am UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266/2 "2025-03-16T09:07:55Z")

</div>

For example, Whatsapp uses multiple domains:

```auto
    whatsapp.net
    whatsapp.com
    wa.me
    wl.co
    whatsapp-plus.info
    whatsapp-plus.me
    whatsapp-plus.net
    whatsapp.cc
    whatsapp.info
    whatsapp.org
    whatsapp.tv
    whatsappbrand.com

```

Getting the IP for each of these domains would take a while.

---

<div class="post-metadata">

**Author:** ![daniel.harada](https://avatars.discourse-cdn.com/v4/letter/d/d6d6ee/32.png) [@daniel.harada](https://forum.elastiflow.com/u/daniel.harada)\
**Post date:** [March 16, 2025, 10:05pm UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266/3 "2025-03-16T22:05:37Z")

</div>

If you have DNS enrichment the ‘whatsapp’ hosts should resolve and you can filter on that.

[https://docs.elastiflow.com/docs/config\_ref/snmpcoll/enrich\_ip\_hostname/#ef\_processor\_enrich\_ipaddr\_dns\_enable](https://docs.elastiflow.com/docs/config_ref/snmpcoll/enrich_ip_hostname/#ef_processor_enrich_ipaddr_dns_enable)

The app id lookup is if there is ‘option data’ in the flow record that we can reference. "NetObserv Flow will cache application attributes learned from option data. "

Let me know if this is helpful or if I have misunderstood the question.

Regards,  
Dexter

---

<div class="post-metadata">

**Author:** ![jeverett](https://avatars.discourse-cdn.com/v4/letter/j/b5ac83/32.png) [@jeverett](https://forum.elastiflow.com/u/jeverett)\
**Post date:** [March 25, 2025, 5:25pm UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266/4 "2025-03-25T17:25:19Z")

</div>

Doesn’t Name Resolution just enrich the:  
`flow.*.host.name`  
fields with a resolved RDNS lookup, rather than just an IP.

I thinks he’s asking about getting the:  
`app.*`  
fields populated with values from an ipport.yml entry with a DNS name, rather than an IP address, specified.  
That is, he’s looking for an ipport.yml entry like:

```auto
whatsapp.com,whatsapp.net,whatsapp.org:
  443:
    name: whatsapp
    category: instant-messaging
    subcategory: consumer-multimedia-messaging
    metadata:
      app.group.name: other

```

to work,  
rather than just an entry like,

```auto
31.13.67.52:
  443:
    name: whatsapp
    category: instant-messaging
    subcategory: consumer-multimedia-messaging
    metadata:
      app.group.name: other

```

All of the example entries for ipport.yml in the docs just show mappings of IP and Port, not DNS names:  
[Applications | ElastiFlow](https://docs.elastiflow.com/docs/config_ref/flowcoll/enrich_apps#ef_processor_enrich_app_ipport_path)

---

<div class="post-metadata">

**Author:** ![system](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.elastiflow.com/system/32/59_2.png) [@system](https://forum.elastiflow.com/u/system)\
**Post date:** [April 24, 2025, 5:25pm UTC](https://forum.elastiflow.com/t/specify-domains-in-etc-elastiflow-app-ipport-yml/266/5 "2025-04-24T17:25:54Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.