> For the complete documentation index, see [llms.txt](https://docs.netcap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netcap.io/v0.5/resolvers.md).

# Resolvers

Historical v0.5 resolver documentation; legacy database distribution retired

This is the historical Netcap v0.5 documentation. Its bundled resolver ZIP and legacy v1/v2 database distribution are retired. Do not use historical archives or third-party download instructions from older copies of this page.

## Current Installation

Upgrade using [Netcap Go releases](https://github.com/dreadl0ck/netcap/releases/latest) or [Netcap Rust releases](https://github.com/dreadl0ck/netcap-rs/releases/latest), then follow the [current resolver guide](https://docs.netcap.io/resolvers) and [current installation guide](https://docs.netcap.io/installation).

```sh
net util -download-dbs
net util -update-dbs
```

These commands require a signed-update-capable client (Go v0.15.2 / Rust v0.1.9 or compatible newer versions). They are not upgrade instructions for the v0.5 executable. Current data defaults to `~/.config/netcap/dbs`, with `NC_CONFIG_ROOT` selecting its parent.

| Historical data source                     | Current replacement/status                                                        |
| ------------------------------------------ | --------------------------------------------------------------------------------- |
| MaxMind bundled geolocation                | DB-IP Lite community City/ASN; optional user-supplied GeoLite2 has separate terms |
| macaddress.io vendor database              | Embedded OUI table                                                                |
| Alexa domain whitelist                     | Retired; no community whitelist distributed                                       |
| Trisul/ja3er JA3 identification catalogues | Not shipped                                                                       |
| Nmap service-probe catalogue               | Reader retired; bounded built-in protocol signatures                              |
| Legacy CMS/DHCP OS catalogues              | Enrichment disabled; packet decoding remains                                      |
| CVE data                                   | NVD-only SQLite schema 2 with structured applicability and reference URLs         |

## Historical Configuration

The v0.5 flags and paths are historical interfaces. Consult the installed executable's help and the [v0.5 source tag](https://github.com/dreadl0ck/netcap/tree/v0.5) when investigating old captures. A historical source reference does not establish redistribution permission for its former third-party data.

Passive DNS and system reverse-DNS resolution remain distinct: reverse lookups can generate network traffic. For current options and file ownership, use the current resolver guide rather than placing user files into a managed signed release.