eping 4.1__tar.gz → 4.4__tar.gz

{eping-4.1 → eping-4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eping
-Version: 4.1
+Version: 4.4
 Summary: Continuous ICMP reachability monitor built on fping, with a CSV logfile analyser (epinga)
 Author-email: Ewald Jeitler <ewald@jeitler.cc>
 License: GPL-3.0-or-later
@@ -17,7 +17,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Dynamic: license-file
 
-# eping.py 4.01
+# eping.py 4.04
 
 Continuous ICMP reachability monitor built on `fping`. Scans a host list in a loop,
 reports each host UP/DOWN/NO-DNS, counts state changes. CLI (curses) or web GUI.
@@ -235,8 +235,8 @@ Single self-contained page, no external resources.
 
 - Table: CLI-style columns, filled top-down then next column right. Horizontal scroll
   if needed ("SCROLL RIGHT FOR MORE" hint in the stats bar).
-- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING, for the whole current view regardless
-  of the match filter and the ADV FILTER (HOSTS-SHOWN = shown count). The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
+- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING always count all hosts; SHOWN is the
+  number of rows displayed after the view, the match filter and the ADV FILTER. The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
 - Adding many hosts (`ADD`, ADD HOSTS FILE, upload) shows "added N host(s) - please wait,
   pinging ..." until they appear with a state, then `done`.
 - Font size 6–28px (slider, `A−`/`A+`, `+`/`−` keys), stored in `localStorage`.
@@ -449,6 +449,7 @@ separated) · `-r` IP range (comma separated, shortened end)
 | `-ssh` | `[USER@]HOST[:PORT]` | off | run fping on a jump host via ssh (see *SSH source (JUMPHOST)*) |
 | `-sshkey` | file | agent | private key file for `-ssh` |
 | `-sshhk` | accept-new/ask/off | accept-new | host key check for `-ssh` |
+| `-sshnr` | — | off | with `-ssh`: do not resolve names on the jump host (use the local resolver) |
 | `-ncf` | — | off | CSV: do not ping the CSV IP of a name without DNS record |
 | `-up` | — | 0 | learning phase: after N rounds show only hosts seen UP (view CURRENTLY-UP; all hosts are still pinged until SET REFERENCE) |
 | `-setref` | — | off | with `-up`: hosts seen UP become new reference list |
@@ -509,24 +510,31 @@ these rows automatically.
 ## SSH source (JUMPHOST)
 
 Run fping on a jump host instead of locally (system `ssh` only). Any Linux host with a working `fping`
-(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`);
+(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`, `-sshnr`);
 the password or key passphrase is asked on the terminal at startup. At runtime: `J` in the CLI,
 JUMPHOST button in the web GUI (after ADV OPTIONS).
 
 ![JUMPHOST window](https://raw.githubusercontent.com/ewaldj/eping/main/docs/img/jumphost.png)
 
-- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, KEY FILE. TEST checks ssh, login and
+- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, NAMES, KEY FILE. TEST checks ssh, login and
   fping on the jump host, CONNECT switches the scan source, USE LOCAL switches back. A missing local
   `ssh` is shown in the window.
 - HOST KEY: `accept-new` (default) - hosts seen for the first time are trusted automatically, a changed
   key is still refused; `ask` - an unknown key is shown with its fingerprint and must be accepted with
   TRUST KEY; `off` - no check at all (insecure).
+- NAMES (default on): the DNS lookups eping does itself - GET NAMES, PREFER HOSTNAME / IP ADDRESS, IP ONLY -
+  run on the jump host over the same ssh connection (no second login), using `getent`, else `dig`,
+  `nslookup` or `host` there; TEST/CONNECT report which tool works. One batch per call, names are validated
+  and sent via stdin. Without a working tool, or with the option off (`-sshnr`), the local resolver is used
+  and GET NAMES is not available. The DNS caches are cleared on every source switch.
+  A name with only an AAAA record is pinged with `fping -6` there (A is preferred, as locally). Without a resolver on
+  the jump host, a name that fping reports as NO-DNS is tried with `-6` in the next round, alternating with `-4`; `-4` / `-6` force one family.
 - The switch is applied at the start of the next round; hosts, states and counters are kept.
 - Connection loss: results of the round are discarded, hosts keep their state, a banner is shown and
   eping reconnects. Logged as `#COMMENT#` rows (`JUMPHOST ... OFFLINE: <reason>`, `JUMPHOST ... ONLINE
   again`, `SOURCE SWITCH <old> -> <new>`), shown in the report's comment timeline.
 - Log column `SOURCE`: `local` or the jump host of each row.
-- Limits: GET NAMES and the CSV-IP fallback are not available over ssh; at most 4 ssh processes
+- Limits: the CSV-IP fallback is not available over ssh; at most 4 ssh processes
   (2 on Windows); the web password transfer is plain HTTP - use `-bind 127.0.0.1` or a trusted network.
 
 ## Web GUI header

{eping-4.1 → eping-4.4}/README.md

@@ -1,4 +1,4 @@
-# eping.py 4.01
+# eping.py 4.04
 
 Continuous ICMP reachability monitor built on `fping`. Scans a host list in a loop,
 reports each host UP/DOWN/NO-DNS, counts state changes. CLI (curses) or web GUI.
@@ -216,8 +216,8 @@ Single self-contained page, no external resources.
 
 - Table: CLI-style columns, filled top-down then next column right. Horizontal scroll
   if needed ("SCROLL RIGHT FOR MORE" hint in the stats bar).
-- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING, for the whole current view regardless
-  of the match filter and the ADV FILTER (HOSTS-SHOWN = shown count). The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
+- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING always count all hosts; SHOWN is the
+  number of rows displayed after the view, the match filter and the ADV FILTER. The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
 - Adding many hosts (`ADD`, ADD HOSTS FILE, upload) shows "added N host(s) - please wait,
   pinging ..." until they appear with a state, then `done`.
 - Font size 6–28px (slider, `A−`/`A+`, `+`/`−` keys), stored in `localStorage`.
@@ -430,6 +430,7 @@ separated) · `-r` IP range (comma separated, shortened end)
 | `-ssh` | `[USER@]HOST[:PORT]` | off | run fping on a jump host via ssh (see *SSH source (JUMPHOST)*) |
 | `-sshkey` | file | agent | private key file for `-ssh` |
 | `-sshhk` | accept-new/ask/off | accept-new | host key check for `-ssh` |
+| `-sshnr` | — | off | with `-ssh`: do not resolve names on the jump host (use the local resolver) |
 | `-ncf` | — | off | CSV: do not ping the CSV IP of a name without DNS record |
 | `-up` | — | 0 | learning phase: after N rounds show only hosts seen UP (view CURRENTLY-UP; all hosts are still pinged until SET REFERENCE) |
 | `-setref` | — | off | with `-up`: hosts seen UP become new reference list |
@@ -490,24 +491,31 @@ these rows automatically.
 ## SSH source (JUMPHOST)
 
 Run fping on a jump host instead of locally (system `ssh` only). Any Linux host with a working `fping`
-(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`);
+(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`, `-sshnr`);
 the password or key passphrase is asked on the terminal at startup. At runtime: `J` in the CLI,
 JUMPHOST button in the web GUI (after ADV OPTIONS).
 
 ![JUMPHOST window](https://raw.githubusercontent.com/ewaldj/eping/main/docs/img/jumphost.png)
 
-- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, KEY FILE. TEST checks ssh, login and
+- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, NAMES, KEY FILE. TEST checks ssh, login and
   fping on the jump host, CONNECT switches the scan source, USE LOCAL switches back. A missing local
   `ssh` is shown in the window.
 - HOST KEY: `accept-new` (default) - hosts seen for the first time are trusted automatically, a changed
   key is still refused; `ask` - an unknown key is shown with its fingerprint and must be accepted with
   TRUST KEY; `off` - no check at all (insecure).
+- NAMES (default on): the DNS lookups eping does itself - GET NAMES, PREFER HOSTNAME / IP ADDRESS, IP ONLY -
+  run on the jump host over the same ssh connection (no second login), using `getent`, else `dig`,
+  `nslookup` or `host` there; TEST/CONNECT report which tool works. One batch per call, names are validated
+  and sent via stdin. Without a working tool, or with the option off (`-sshnr`), the local resolver is used
+  and GET NAMES is not available. The DNS caches are cleared on every source switch.
+  A name with only an AAAA record is pinged with `fping -6` there (A is preferred, as locally). Without a resolver on
+  the jump host, a name that fping reports as NO-DNS is tried with `-6` in the next round, alternating with `-4`; `-4` / `-6` force one family.
 - The switch is applied at the start of the next round; hosts, states and counters are kept.
 - Connection loss: results of the round are discarded, hosts keep their state, a banner is shown and
   eping reconnects. Logged as `#COMMENT#` rows (`JUMPHOST ... OFFLINE: <reason>`, `JUMPHOST ... ONLINE
   again`, `SOURCE SWITCH <old> -> <new>`), shown in the report's comment timeline.
 - Log column `SOURCE`: `local` or the jump host of each row.
-- Limits: GET NAMES and the CSV-IP fallback are not available over ssh; at most 4 ssh processes
+- Limits: the CSV-IP fallback is not available over ssh; at most 4 ssh processes
   (2 on Windows); the web password transfer is plain HTTP - use `-bind 127.0.0.1` or a trusted network.
 
 ## Web GUI header

{eping-4.1 → eping-4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "eping"
-version = "4.01"
+version = "4.04"
 description = "Continuous ICMP reachability monitor built on fping, with a CSV logfile analyser (epinga)"
 readme = "README.md"
 license = { text = "GPL-3.0-or-later" }

{eping-4.1 → eping-4.4}/src/eping/eping.py

@@ -7,7 +7,7 @@
 # I knew how it worked.
 # Now, only god knows it!
 # - - - - - - - - - - - - - - - - - - - - - - - -
-VERSION = '4.01'
+VERSION = '4.04'
 version = VERSION  # legacy alias (kept for existing references)
 
 # --- scaling limits ---
@@ -545,13 +545,26 @@ _source_events = []       # pending comment texts (JUMPHOST OFFLINE / ONLINE, SO
 _ssh_pending  = None      # None = no change, False = switch to local, SshCfg = switch to it
 _ssh_lock     = threading.Lock()
 _ssh_cfgs     = []        # every SshCfg that owns a temp dir (cleaned at exit)
-_jump_last    = {'host': '', 'port': '', 'user': '', 'key': '', 'hostkey': 'accept-new'}   # form values of the last try (never the secret)
+_jump_last    = {'host': '', 'port': '', 'user': '', 'key': '', 'hostkey': 'accept-new', 'resolve': True}   # form values of the last try (never the secret)
 _jump_hostkeys = {}       # (host, port) -> hashed known_hosts lines offered by TRUST KEY
 
+# Name resolution on the jump host: with a working resolver tool there (getent, dig,
+# nslookup or host - found and probed by ssh_check) the DNS lookups that eping does
+# itself (GET NAMES, PREFER HOSTNAME / IP ADDRESS, IP ONLY) run there, over the same ssh
+# connection, instead of on this computer. Results are cached per source.
+JR_TOOLS = ('getent', 'dig', 'nslookup', 'host')   # in order of preference
+JR_CHUNK = 400                                      # names per ssh call
+_jr_fwd = {}                  # name -> (ips, expires_at)
+_jr_rev = {}                  # ip -> (name or None, expires_at)
+_jr_cache_lock = threading.Lock()
+_jr_run_lock   = threading.Lock()      # one remote lookup batch at a time
+
 class SshCfg(object):
     """One jump host: where, how to log in, and its private temp dir (ControlPath + askpass)."""
-    def __init__(self, host, user=None, port=None, key=None, secret='', hostkey='accept-new'):
+    def __init__(self, host, user=None, port=None, key=None, secret='', hostkey='accept-new', resolve=True):
         self.host, self.user, self.port = host, (user or None), (port or None)
+        self.resolve = bool(resolve)     # wish: resolve names on the jump host
+        self.resolver = ''               # tool that works there ('' = none / not checked)
         self.hostkey = hostkey if hostkey in SSH_HOSTKEY_MODES else 'accept-new'
         self.key = os.path.expanduser(key) if key else None
         self.secret = secret or ''
@@ -668,24 +681,161 @@ def ssh_wrap(argv, c=None):
         SSH_REMOTE_PATH, ' '.join(shlex.quote(a) for a in argv))
     return ssh_base(c) + [c.target, 'sh -c ' + shlex.quote(inner)]
 
-def ssh_exec(c, script, timeout=SSH_TEST_TIMEOUT):
-    """Run a /bin/sh script on jump host c. Returns (returncode, output)."""
+def ssh_exec(c, script, timeout=SSH_TEST_TIMEOUT, stdin_text=None):
+    """Run a /bin/sh script on jump host c (optionally feeding stdin_text). Returns (returncode, output)."""
     inner = 'PATH="$PATH:%s"; export PATH\n%s' % (SSH_REMOTE_PATH, script)
+    kw = {'input': stdin_text} if stdin_text is not None else {'stdin': subprocess.DEVNULL}
     try:
         p = subprocess.run(ssh_base(c) + [c.target, 'sh -c ' + shlex.quote(inner)],
-                           stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
-                           encoding='utf-8', errors='replace', timeout=timeout, env=ssh_env(c))
+                           stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                           encoding='utf-8', errors='replace', timeout=timeout, env=ssh_env(c), **kw)
         return p.returncode, p.stdout or ''
     except FileNotFoundError:
         return 255, 'ssh command not found'
     except subprocess.TimeoutExpired:
         return 255, 'ssh timeout'
 
-_SSH_CHECK = r'''command -v fping >/dev/null 2>&1 || { echo EPING_NOFPING; exit 0; }
+_SSH_CHECK = r'''RES=""; for t in getent dig nslookup host; do command -v $t >/dev/null 2>&1 && { RES=$t; break; }; done
+echo "EPING_RESOLVER=$RES"
+command -v fping >/dev/null 2>&1 || { echo EPING_NOFPING; exit 0; }
 echo "EPING_VERSION=$(fping -v 2>&1 | head -1)"
 out=$(fping -4 -c1 -t500 127.0.0.1 2>&1); echo "EPING_RC=$?"; echo "EPING_OUT=$out"
 echo EPING_HELP_BEGIN; fping -h 2>&1; echo EPING_HELP_END'''
 
+# One lookup per input line, up to 16 in parallel (xargs -P). The body must not contain
+# single quotes: it is wrapped into sh -c '...'. Result line: "<input> <answers...>".
+_JR_FWD = {
+    'getent':   r'r=$(getent ahosts "$0" 2>/dev/null | awk "{print \$1}" | sort -u | tr "\n" " ")',
+    'dig':      r'r=$( (dig +short +time=3 +tries=1 A "$0"; dig +short +time=3 +tries=1 AAAA "$0") 2>/dev/null | grep -E "^[0-9a-fA-F:.]+\$" | sort -u | tr "\n" " ")',
+    'nslookup': r'r=$(nslookup -timeout=3 "$0" 2>/dev/null | awk "/^Name:/{f=1} f&&/^Address/{print \$NF}" | sort -u | tr "\n" " ")',
+    'host':     r'r=$(host -W 3 "$0" 2>/dev/null | awk "/has address|has IPv6 address/{print \$NF}" | sort -u | tr "\n" " ")',
+}
+_JR_REV = {
+    'getent':   r'r=$(getent hosts "$0" 2>/dev/null | awk "NR==1{print \$2}")',
+    'dig':      r'r=$(dig +short +time=3 +tries=1 -x "$0" 2>/dev/null | head -1)',
+    'nslookup': r'r=$(nslookup -timeout=3 "$0" 2>/dev/null | awk "/name = /{print \$NF; exit}")',
+    'host':     r'r=$(host -W 3 "$0" 2>/dev/null | awk "/domain name pointer/{print \$NF; exit}")',
+}
+
+def _jr_run(mode, items, c):
+    """Look up items ('fwd': names -> addresses, 'rev': addresses -> name) on jump host c
+    with its resolver tool. Returns {item: [answer tokens]}; items of a failed batch are
+    missing. Input is validated (no shell metacharacters) and goes in via stdin."""
+    body = (_JR_FWD if mode == 'fwd' else _JR_REV)[c.resolver]
+    script = ('XP=-P16; echo x | xargs -P16 -n1 true >/dev/null 2>&1 || XP=""\n'
+              "xargs -n1 $XP sh -c '" + body + '; echo "$0 $r"' + "'")
+    out = {}
+    items = [i for i in items if re.match(r'^[A-Za-z0-9._:-]{1,253}$', i)]
+    for k in range(0, len(items), JR_CHUNK):
+        chunk = items[k:k + JR_CHUNK]
+        rc, text = ssh_exec(c, script, timeout=30 + len(chunk) // 5, stdin_text='\n'.join(chunk) + '\n')
+        if rc != 0:
+            continue
+        for line in text.splitlines():
+            parts = line.split()
+            if parts and parts[0] in chunk:
+                out[parts[0]] = parts[1:]
+    return out
+
+def jr_active():
+    """True if lookups go to the jump host (ssh source, enabled, working resolver)."""
+    c = ssh_cfg
+    return bool(c is not None and c.resolve and c.resolver)
+
+def _jr_ttl():
+    try:
+        return max(30.0, float(getattr(globals().get('args'), 'dns_ttl', 300)))
+    except Exception:
+        return 300.0
+
+def jr_forward(names):
+    """{name: [addresses]} resolved on the jump host (cached, one ssh call for all
+    uncached names). A name whose batch failed is missing in the result."""
+    c = ssh_cfg
+    if not jr_active():
+        return {}
+    now = time.time()
+    res, todo = {}, []
+    with _jr_cache_lock:
+        for n in set(names):
+            e = _jr_fwd.get(n)
+            if e and e[1] > now:
+                res[n] = e[0]
+            else:
+                todo.append(n)
+    if todo:
+        with _jr_run_lock:
+            got = _jr_run('fwd', todo, c)
+        now, ttl = time.time(), _jr_ttl()
+        with _jr_cache_lock:
+            for n in todo:
+                if n not in got:
+                    res[n] = []
+                    _jr_fwd[n] = ([], now + DNS_FAIL_TTL)    # failed batch / bad name: retry later
+                    continue
+                ips = []
+                for a in got[n]:
+                    try:
+                        ipaddress.ip_address(a)
+                        ips.append(a)
+                    except ValueError:
+                        pass
+                _jr_fwd[n] = (ips, now + (ttl if ips else min(ttl, DNS_FAIL_TTL)))
+                res[n] = ips
+    return res
+
+def jr_reverse(ips):
+    """{ip: hostname or None} (PTR) looked up on the jump host, cached."""
+    c = ssh_cfg
+    if not jr_active():
+        return {}
+    now = time.time()
+    res, todo = {}, []
+    with _jr_cache_lock:
+        for i in set(ips):
+            e = _jr_rev.get(i)
+            if e and e[1] > now:
+                res[i] = e[0]
+            else:
+                todo.append(i)
+    if todo:
+        with _jr_run_lock:
+            got = _jr_run('rev', todo, c)
+        now, ttl = time.time(), _jr_ttl()
+        with _jr_cache_lock:
+            for i in todo:
+                if i in got:
+                    nm = got[i][0].rstrip('.') if got[i] else None
+                    _jr_rev[i] = (nm or None, now + (ttl if nm else min(ttl, DNS_FAIL_TTL)))
+                    res[i] = nm or None
+                else:
+                    res[i] = None
+                    _jr_rev[i] = (None, now + DNS_FAIL_TTL)
+    return res
+
+_ssh_fam6 = set()     # hostnames tried with fping -6 on the jump host (no resolver there, see below)
+
+def ssh_name_family(name):
+    """Address family ('4'/'6') used for the fping run of a hostname on the jump host.
+    With a resolver there the names are looked up first (A preferred, AAAA if there is
+    no A record - same rule as locally), so an IPv6-only name is pinged with -6.
+    Without one, -4 is used and a name that fping reports as NO-DNS is tried with -6
+    in the next round (and back to -4 if that fails too), see run_ping_round()."""
+    if dns_family in ('4', '6'):
+        return dns_family
+    if jr_active():
+        ips = resolve_all_ips(name)
+        if ips:
+            return ip_version_str(ips[0]) or '4'
+        return '4'
+    return '6' if name in _ssh_fam6 else '4'
+
+def jr_prefetch(hosts):
+    """Resolve all hostnames of 'hosts' on the jump host in one go (fills the cache, so
+    the per-name lookups of the callers below do not each need an ssh call)."""
+    if jr_active():
+        jr_forward([h for h in hosts if not is_ip_host(h)])
+
 def ssh_scan_hostkeys(c):
     """Fetch the jump host's keys (hashed known_hosts lines) and their fingerprints."""
     lines, fps = [], []
@@ -758,6 +908,15 @@ def ssh_check(c):
     m = re.search(r'EPING_HELP_BEGIN\n(.*)EPING_HELP_END', out, re.S)
     r.update(ok=True, code='ok', help=(m.group(1) if m else ''))
     c.help, c.version = r['help'], r['version']
+    # resolver on the jump host: tool found by the check script, then a real lookup
+    c.resolver = ''
+    tool = (re.search(r'EPING_RESOLVER=(\w*)', out) or [None, ''])[1]
+    if tool in JR_TOOLS:
+        c.resolver = tool
+        got = _jr_run('fwd', ['localhost'], c)
+        if not any(a in ('127.0.0.1', '::1') for a in got.get('localhost', [])):
+            c.resolver = ''
+    r['resolver'] = c.resolver
     return r
 
 def ssh_activate(c):
@@ -770,6 +929,13 @@ def ssh_activate(c):
     _fping_caps = None
     _source_down = False
     _source_alert = ''
+    with _jr_cache_lock:
+        _jr_fwd.clear()
+        _jr_rev.clear()
+    _ssh_fam6.clear()
+    with _dns_lock:                      # lookups made for the old source do not apply
+        _dns_cache.clear()
+        _addr_redundancy_cache.clear()
     if old is not None and old is not c:
         old.close()
 
@@ -792,7 +958,7 @@ def ssh_apply_pending():
     ssh_activate(p if p is not False else None)
     _source_events.append('SOURCE SWITCH %s -> %s' % (old, SOURCE_LABEL))
 
-def ssh_init(target, key, hostkey='accept-new'):
+def ssh_init(target, key, hostkey='accept-new', resolve=True):
     """-ssh at startup: ask for the secret, trust the host key (ssh's own prompt), verify
     that fping works on the jump host. Exits with a clear message on any problem."""
     parsed = ssh_parse_target(target)
@@ -811,7 +977,7 @@ def ssh_init(target, key, hostkey='accept-new'):
                                      % ((user + '@' if user else '') + host))
         except (EOFError, KeyboardInterrupt):
             error_handler("ERROR: -ssh: aborted")
-    c = SshCfg(host, user, port, key, secret, hostkey)
+    c = SshCfg(host, user, port, key, secret, hostkey, resolve)
     print('SSH source %s: connecting ...' % c.label)
     sys.stdout.flush()
     r = ssh_check(c)
@@ -831,6 +997,9 @@ def ssh_init(target, key, hostkey='accept-new'):
         error_handler("ERROR: -ssh: " + r['error'])
     ssh_activate(c)
     print('SSH source %s: OK (%s)' % (c.label, r['version']))
+    print('Name resolution: ' + (('on the jump host (%s)' % c.resolver) if (c.resolve and c.resolver)
+          else ('local (disabled by -sshnr)' if not c.resolve
+                else 'local (no working getent/dig/nslookup/host on the jump host)')))
     sys.stdout.flush()
 
 def jump_cfg_from(req):
@@ -851,11 +1020,13 @@ def jump_cfg_from(req):
     hk = str(req.get('hostkey', 'accept-new'))
     if hk not in SSH_HOSTKEY_MODES:
         hk = 'accept-new'
-    _jump_last.update(host=host, user=user, port=port, key=key, hostkey=hk)
-    return SshCfg(host, user, int(port) if port else None, key, secret, hk), ''
+    resolve = str(req.get('resolve', True)).strip().lower() not in ('0', 'false', 'off', 'no')
+    _jump_last.update(host=host, user=user, port=port, key=key, hostkey=hk, resolve=resolve)
+    return SshCfg(host, user, int(port) if port else None, key, secret, hk, resolve), ''
 
 def jump_info():
     return {'ssh': ssh_prereq(), 'active': SOURCE_LABEL if ssh_cfg else '', 'last': dict(_jump_last),
+            'resolver': (ssh_cfg.resolver if (ssh_cfg and ssh_cfg.resolve) else ''),
             'pending': ('local' if _ssh_pending is False else (_ssh_pending.label if _ssh_pending else ''))}
 
 def jump_handle(req):
@@ -873,11 +1044,18 @@ def jump_handle(req):
         e = ssh_trust_hostkeys(c.host, c.port)
         return dict(ok=not e, code='trust', error=e, message='' if e else 'host key trusted - press TEST')
     r = ssh_check(c)
+    note = ''
+    if r['ok']:
+        note = ('; names are resolved on the jump host (%s)' % c.resolver if (c.resolve and c.resolver)
+                else ('; names are resolved locally (option off)' if not c.resolve
+                      else '; names are resolved locally (no working getent/dig/nslookup/host there)'))
     if act == 'test' or not r['ok']:
         c.close()
+        if r['ok']:
+            r['message'] = 'OK - ' + (r['version'] or 'fping works') + note
         return r
     ssh_request(c)                               # connect
-    r['message'] = 'connected to %s - switching at the next round' % c.label
+    r['message'] = 'connected to %s - switching at the next round%s' % (c.label, note)
     return r
 
 def source_set(down, reason=''):
@@ -987,6 +1165,20 @@ def resolve_all_ips(name, family=None):
     Uncached and used only where all addresses matter (prefer-hostname redundancy
     check) or once per name resolution - not hot enough to need caching here."""
     fam = family if family is not None else dns_family
+    if jr_active():                       # the jump host's view of DNS
+        ips = jr_forward([name]).get(name) or []
+        v4, v6 = [], []
+        for a in ips:
+            ip = ipaddress.ip_address(a)
+            if ip.version == 4:
+                v4.append(a)
+            elif not ip.ipv4_mapped:
+                v6.append(a)
+        key = lambda a: int(ipaddress.ip_address(a))
+        for grp in ((v6, v4) if fam == '6' else (v4, v6)):
+            if grp:
+                return sorted(grp, key=key)
+        return []
     af_list = {'4': [socket.AF_INET, socket.AF_INET6],
               '6': [socket.AF_INET6, socket.AF_INET]}.get(
         fam, [socket.AF_INET, socket.AF_INET6])
@@ -1031,6 +1223,9 @@ def get_names_for_ips(ip_list, timeout=DNS_PTR_TIMEOUT, workers=DNS_RESOLVERS):
     this runs."""
     if not ip_list:
         return {}
+    if jr_active():                       # PTR lookups on the jump host
+        got = jr_reverse(list(ip_list))
+        return dict((ip, got.get(ip)) for ip in ip_list)
     old_timeout = socket.getdefaulttimeout()
     socket.setdefaulttimeout(timeout)
     results = {}
@@ -1108,6 +1303,8 @@ def _forward_confirms(name, ip):
     that resolves back to exactly this ip. Guards GET NAMES: a PTR record with no
     matching forward record must not be used to rename a host, or pinging it
     afterwards by name would fail (NO-DNS) or silently hit a different address."""
+    if jr_active():
+        return ip in (jr_forward([name]).get(name) or [])
     try:
         af = socket.AF_INET6 if ip_version_str(ip) == '6' else socket.AF_INET
         infos = socket.getaddrinfo(name, None, af, socket.SOCK_DGRAM)
@@ -1127,6 +1324,8 @@ def _get_names_lookup(candidates):
     ptr = get_names_for_ips(candidates)
     checkable = [ip for ip in candidates if ptr.get(ip) and match_re(ptr[ip], fqdn_re)]
     fwd_ok = {}
+    if checkable and jr_active():
+        jr_forward([ptr[ip] for ip in checkable])      # one ssh call for all forward checks
     if checkable:
         with concurrent.futures.ThreadPoolExecutor(
                 max_workers=max(1, min(DNS_RESOLVERS, len(checkable)))) as pool:
@@ -1200,6 +1399,7 @@ def apply_get_names(original_hosts_list, active_hosts_list, host_state, up_seen,
     only used at startup (-gn), before the CLI/web loop exists to stay responsive
     for. The interactive [G] key/cmd runs this in the background instead, see
     get_names_start()/get_names_finish()."""
+    jr_prefetch(original_hosts_list)
     covered_ips = set()
     for h in original_hosts_list:
         if not is_ip_host(h):
@@ -1223,8 +1423,9 @@ def get_names_start(original_hosts_list, dns_ttl):
     Returns (thread, result_holder, candidates); thread is None (nothing started)
     when there is nothing to look up. Poll thread.is_alive() and, once False, call
     get_names_finish() with result_holder."""
-    if ssh_target:                          # reverse DNS here would not match the jump host's view
+    if ssh_target and not jr_active():      # reverse DNS here would not match the jump host's view
         return None, None, []
+    jr_prefetch(original_hosts_list)
     covered_ips = set()
     for h in original_hosts_list:
         if not is_ip_host(h):
@@ -1716,6 +1917,13 @@ def view_hosts(mode, hosts, host_state, tz_offset, flap_window=FLAP_WINDOW_DEF):
         return hosts
     return filter_hosts(mode, hosts, host_state, tz_offset, flap_window)
 
+def view_rows(rows, mode, host_state, tz_offset, flap_window=FLAP_WINDOW_DEF):
+    """Rows (from build_display) of the hosts shown by the view 'mode' (live)."""
+    if mode <= 0:
+        return rows
+    keep = set(filter_hosts(mode, [r[0] for r in rows], host_state, tz_offset, flap_window))
+    return [r for r in rows if r[0] in keep]
+
 def filter_hosts(mode, original_hosts_list, host_state, tz_offset,
                  flap_window=FLAP_WINDOW_DEF, up_seen=None):
     """Host list for the given view mode - a snapshot, taken when the view switches.
@@ -1840,6 +2048,7 @@ def apply_prefer_hostname(hosts_list, dns_ttl):
     hostname's resolved addresses are cached for this check - see _cached_all_ips()."""
     hostname_ips = set()
     names = [h for h in hosts_list if not is_ip_host(h)]
+    jr_prefetch(names)
     if len(names) > 1:     # resolve in parallel - serial lookups of unresolvable names are slow
         with concurrent.futures.ThreadPoolExecutor(max_workers=32) as ex:
             for ips in ex.map(lambda n: _cached_all_ips(n, dns_ttl), names):
@@ -1859,6 +2068,7 @@ def apply_prefer_ip(hosts_list, dns_ttl):
     raw_ips = set(h for h in hosts_list if is_ip_host(h))
     if not raw_ips:
         return list(hosts_list)
+    jr_prefetch(hosts_list)
     return [h for h in hosts_list
             if is_ip_host(h) or not raw_ips.intersection(_cached_all_ips(h, dns_ttl))]
 
@@ -1878,6 +2088,7 @@ def apply_ip_only_on(original_hosts_list, active_hosts_list, host_state, up_seen
     entries."""
     existing = set(h.lower() for h in original_hosts_list)
     ip_map, unresolved, dropped = {}, 0, 0
+    jr_prefetch(original_hosts_list)
     for h in list(original_hosts_list):
         if is_ip_host(h):
             continue
@@ -1932,6 +2143,7 @@ def apply_ip_only_on_web(original_hosts_list, active_hosts_list, host_state,
     uses apply_ip_only_on above and keeps the old drop-on-collision behaviour."""
     existing = set(h.lower() for h in original_hosts_list)
     ip_map, unresolved, skipped = {}, 0, 0
+    jr_prefetch(original_hosts_list)
     for h in list(original_hosts_list):
         if is_ip_host(h):
             continue
@@ -2732,12 +2944,14 @@ def run_ping_round(active_hosts_list, threads_arg, rate_pps=DEFAULT_RATE_PPS,
     # group above is split again by address family. In the common single-family
     # case this yields exactly one subgroup per group, same as before IPv6 support.
     subgroups = []   # (targets, retries, label, family)
+    if ssh_target and jr_active():
+        jr_prefetch(targets)                 # one ssh call for all uncached names
     for grp_targets, grp_retries, grp_name in groups:
         by_fam = {'4': [], '6': []}
         for t in grp_targets:
             fam = ip_version_str(t)
             if not fam and ssh_target:             # name resolved on the jump host
-                fam = '6' if dns_family == '6' else '4'
+                fam = ssh_name_family(t)
             if fam:
                 by_fam[fam].append(t)
         for fam in ('4', '6'):
@@ -2835,6 +3049,13 @@ def run_ping_round(active_hosts_list, threads_arg, rate_pps=DEFAULT_RATE_PPS,
             new_row[0] = display_name
             rows.append(new_row)
 
+    if ssh_target and not jr_active() and dns_family == 'auto':
+        for r in rows:                       # alternate -4 / -6 for names fping cannot resolve
+            if not is_ip_host(r[0]) and 'NO-DNS' in r[1]:
+                if r[0] in _ssh_fam6:
+                    _ssh_fam6.discard(r[0])
+                else:
+                    _ssh_fam6.add(r[0])
     # names that do not resolve never reach fping - report them like fping would
     if unresolved:
         now_str = get_date_time()
@@ -3299,6 +3520,7 @@ WEB_INDEX_HTML = r"""<!DOCTYPE html>
           <option value="accept-new">accept new hosts automatically (a changed key is still refused)</option>
           <option value="ask">ask - confirm an unknown host key (TRUST KEY)</option>
           <option value="off">off - no host key check at all (insecure)</option></select></td></tr>
+        <tr><td style="padding:3px 8px 3px 0;white-space:nowrap">NAMES</td><td colspan="3"><label style="font-size:12px;cursor:pointer"><input type="checkbox" id="jumpResolve" checked> resolve names on the jump host (getent / dig / nslookup / host; for GET NAMES, PREFER HOSTNAME / IP ADDRESS, IP ONLY)</label></td></tr>
         <tr><td style="padding:3px 8px 3px 0;white-space:nowrap">KEY FILE</td><td colspan="3"><input type="text" id="jumpKey" style="width:100%;box-sizing:border-box" placeholder="optional, path on the computer running eping.py" autocomplete="off" spellcheck="false"></td></tr>
       </table>
       <div id="jumpWarn" style="display:none;font-size:11px;color:var(--flap,#d9a400);margin-top:6px">This page is not served from this computer (HTTP, no encryption): the password would cross the network in clear text. Prefer a key.</div>
@@ -3433,7 +3655,7 @@ WEB_INDEX_HTML = r"""<!DOCTYPE html>
    <span id="ctrls">
     <span class="ctrls-row" id="ctrlsRow1">
      <span id="ctrlsMain">
-      <select id="selFilter" title="choose which hosts are shown and pinged - a host outside the current view is not checked until a view including it is selected again">
+      <select id="selFilter" title="display filter: choose which hosts are shown (evaluated live) - all hosts keep being pinged until SET REFERENCE removes the hosts that are not shown">
         <option value="0">ALL HOSTS</option>
         <option value="1">CURRENTLY-UP</option>
         <option value="3">ALWAYS-UP</option>
@@ -3451,7 +3673,7 @@ WEB_INDEX_HTML = r"""<!DOCTYPE html>
         <option value="3">FLAP/UP/DOWN</option>
         <option value="4">FLAP/DOWN/UP</option>
       </select>
-      <button id="btnSetRef" title="use the hosts currently shown as the new reference list">SET REFERENCE</button>
+      <button id="btnSetRef" title="use the hosts currently shown as the new reference list - all other hosts are removed and no longer pinged">SET REFERENCE</button>
       <button id="btnZero" title="reset CH-TIME and CH NO for all hosts">ZERO CHANGES</button>
       <button id="btnClear" class="danger" title="remove every host from the list, resets all state">CLEAR ALL</button>
       <select id="selAddrMode" title="Deduplication when the same host is entered as both a hostname and its IP: hostname &amp; ip keeps both as given (no dedup) | prefer hostname: skip a raw IP already covered by a hostname | prefer ip address: skip a hostname already covered by a raw IP | ip only: resolve every hostname to its IP and ping/track it by address">
@@ -3524,8 +3746,8 @@ WEB_INDEX_HTML = r"""<!DOCTYPE html>
     <span class="u">HOSTS-UP: <b id="sUp">0</b></span>
     <span class="d">HOSTS-DOWN: <b id="sDown">0</b></span>
     <span>FLAPPING: <b id="sFlap">0</b></span>
-    <span title="hosts matching the display filter, out of the totals above"
-          id="sShownWrap">HOSTS-SHOWN: <b id="sShown">0</b></span>
+    <span title="hosts shown by the view and display filters, out of all hosts"
+          id="sShownWrap">SHOWN: <b id="sShown">0</b></span>
     <span id="sLog"></span>
     <span class="msg" id="msg"></span>
     <span id="scrollHint"></span>
@@ -4603,6 +4825,7 @@ function jumpFields(action){
   return {action: action, host: document.getElementById('jumpHost').value, port: document.getElementById('jumpPort').value,
           user: document.getElementById('jumpUser').value, key: document.getElementById('jumpKey').value,
           hostkey: document.getElementById('jumpHostKey').value,
+          resolve: document.getElementById('jumpResolve').checked,
           secret: document.getElementById('jumpSecret').value};
 }
 function jumpButtons(){
@@ -4640,13 +4863,15 @@ function openJump(){
       if(j.ssh && j.ssh.ok){
         pre.style.color = 'var(--dim)';
         pre.textContent = 'ssh client: ' + (j.ssh.version || 'found') + (j.ssh.keyscan ? '' : ' (ssh-keyscan missing: unknown host keys cannot be trusted here)') +
-          ' | source: ' + (j.active ? j.active : 'local') + (j.pending ? ' (switching to ' + j.pending + ')' : '');
+          ' | source: ' + (j.active ? j.active : 'local') + (j.pending ? ' (switching to ' + j.pending + ')' : '') +
+          (j.active ? ' | names: ' + (j.resolver ? 'jump host (' + j.resolver + ')' : 'local') : '');
       } else {
         pre.style.color = 'var(--down,#f85149)';
         pre.textContent = (j.ssh && j.ssh.hint) || 'OpenSSH client not found on this computer.';
       }
       if(j.last){
         if(j.last.hostkey) document.getElementById('jumpHostKey').value = j.last.hostkey;
+        if(typeof j.last.resolve === 'boolean') document.getElementById('jumpResolve').checked = j.last.resolve;
         ['host','port','user','key'].forEach(function(k){
           var el = document.getElementById('jump' + k.charAt(0).toUpperCase() + k.slice(1));
           if(el && !el.value) el.value = j.last[k] || '';
@@ -5606,7 +5831,7 @@ function poll(){
     document.getElementById('sFlap').textContent    = s.hosts_flap;
     var swrap = document.getElementById('sShownWrap');
     var advOn = !!(s.adv_filter && Object.keys(s.adv_filter).length);
-    swrap.style.display = (s.match_filter || advOn) ? '' : 'none';
+    swrap.style.display = '';   // SHOWN is always visible
     lastAdv = {values: s.adv_values || {}, filter: s.adv_filter || {}};
     document.getElementById('btnAdvFilter').className = advOn ? 'on' : '';
     document.getElementById('sShown').textContent   = s.hosts_shown;
@@ -7182,6 +7407,8 @@ def build_cli_snapshot(args, backoff, timeout, retries, down_retries, flap_windo
             parts.append('-sshkey ' + args.ssh_key)
         if getattr(args, 'ssh_hostkey', 'accept-new') != 'accept-new':
             parts.append('-sshhk ' + args.ssh_hostkey)
+        if getattr(args, 'ssh_no_resolve', False):
+            parts.append('-sshnr')
     return ' '.join(parts)
 
 
@@ -7372,7 +7599,8 @@ def run_web_mode(original_hosts_list, host_state, args, logfile_file_name,
                     gn_thread, gn_result, gn_candidates = get_names_start(
                         original_hosts_list, int(args.dns_ttl))
                     if gn_thread is None:
-                        message = 'get names: no eligible IP host(s)'
+                        message = ('get names: not available - the jump host has no working resolver (or it is switched off)'
+                                   if (ssh_target and not jr_active()) else 'get names: no eligible IP host(s)')
                     else:
                         message = ('get names: running in background (%d host(s))'
                                   % len(gn_candidates))
@@ -7736,10 +7964,13 @@ def run_web_mode(original_hosts_list, host_state, args, logfile_file_name,
         if cmds or gn_just_finished:
             # view and order are pure display changes - show them at once instead of
             # letting the browser wait for the running round, same as the CLI does
-            quick    = build_display(view_hosts(filter_mode, active_hosts_list, host_state, tz_offset, flap_window), host_state, sort_mode,
-                                     tz_offset, flap_window)
-            quick_up = sum(1 for e in quick if 'UP' in e[1])
-            quick_total = len(quick)
+            # HOSTS / HOSTS-UP / HOSTS-DOWN count all hosts, the view and the display
+            # filters only narrow what is SHOWN
+            quick_all = build_display(active_hosts_list, host_state, sort_mode,
+                                      tz_offset, flap_window)
+            quick_up = sum(1 for e in quick_all if 'UP' in e[1])
+            quick_total = len(quick_all)
+            quick    = view_rows(quick_all, filter_mode, host_state, tz_offset, flap_window)
             if match_filter_re is not None or adv_filter:
                 quick = apply_match_filter(quick, match_filter_re)
             with web_lock:
@@ -7836,16 +8067,15 @@ def run_web_mode(original_hosts_list, host_state, args, logfile_file_name,
         phase['state'] = time.time() - _t
 
         _t = time.time()
-        display_list = build_display(view_hosts(filter_mode, active_hosts_list, host_state, tz_offset, flap_window), host_state, sort_mode,
-                                     tz_offset, flap_window)
-        # HOSTS/HOSTS-UP/HOSTS-DOWN are the totals for the whole current view - a
-        # [M] display filter narrows what's SHOWN, not what's actually being pinged,
-        # so it must not make these look like only 2 hosts exist. hosts_count_shown
-        # is the post-filter count, reported separately (HOSTS-SHOWN in the web GUI).
-        hosts_count_up   = sum(1 for e in display_list if 'UP' in e[1])
-        hosts_count_down = len(display_list) - hosts_count_up
-        hosts_count_flap = sum(1 for e in display_list
+        display_all = build_display(active_hosts_list, host_state, sort_mode,
+                                    tz_offset, flap_window)
+        # HOSTS/HOSTS-UP/HOSTS-DOWN/FLAPPING count all hosts - the view and the [M] /
+        # ADV display filters only narrow what is SHOWN (hosts_count_shown below).
+        hosts_count_up   = sum(1 for e in display_all if 'UP' in e[1])
+        hosts_count_down = len(display_all) - hosts_count_up
+        hosts_count_flap = sum(1 for e in display_all
                                if host_is_flapping(e, now_local(tz_offset), flap_window))
+        display_list = view_rows(display_all, filter_mode, host_state, tz_offset, flap_window)
         if match_filter_re is not None or adv_filter:
             display_list = apply_match_filter(display_list, match_filter_re)
         hosts_count_shown = len(display_list)
@@ -7952,6 +8182,7 @@ if __name__=='__main__':
     parser.add_argument('-fs', '--full_sweep', default=str(FULL_SWEEP_DEF), dest='full_sweep', help="every Nth run probes every host with full retries, range 0-" + str(FULL_SWEEP_MAX) + " (default: " + str(FULL_SWEEP_DEF) + ", 0 = disabled/never)")
     parser.add_argument('-ssh', '--ssh', dest='ssh', metavar='[USER@]HOST[:PORT]', default=None, help="run fping on this jump host via ssh instead of locally (system ssh; password or key passphrase is asked at startup; the jump host resolves the names and needs a working fping)")
     parser.add_argument('-sshkey', '--ssh_key', dest='ssh_key', metavar='FILE', default=None, help="private key file for -ssh (default: ssh agent / default keys)")
+    parser.add_argument('-sshnr', '--ssh_no_resolve', action="store_true", dest='ssh_no_resolve', help="with -ssh: do not resolve names on the jump host (default: GET NAMES, PREFER HOSTNAME / IP ADDRESS and IP ONLY use getent / dig / nslookup / host there when available; otherwise the local resolver is used)")
     parser.add_argument('-sshhk', '--ssh_hostkey', dest='ssh_hostkey', choices=SSH_HOSTKEY_MODES, default='accept-new', help="host key check for -ssh: accept-new = trust hosts seen for the first time, a changed key is refused (default); ask = confirm an unknown key; off = no check at all (insecure)")
     parser.add_argument('-ncf', '--no_csv_fallback', action="store_true", dest='no_csv_fallback', help="do not ping the CSV address of a host whose name does not resolve (default: it is pinged by the CSV IP and marked in the host popup)")
     parser.add_argument('-ncs', '--no_check_source', action="store_true", dest='no_check_source', help="do not pass --check-source to fping (only needed for hosts replying from a different address)")
@@ -8318,7 +8549,7 @@ if __name__=='__main__':
     # (CLI: [A]=ADD HOST, web gui: ADD HOST / UPLOAD FILE)
 
     if args.ssh:
-        ssh_init(args.ssh, args.ssh_key, args.ssh_hostkey)
+        ssh_init(args.ssh, args.ssh_key, args.ssh_hostkey, not args.ssh_no_resolve)
     elif args.ssh_key:
         error_handler("ERROR: -sshkey needs -ssh")
 
@@ -8566,13 +8797,15 @@ if __name__=='__main__':
         Same actions as the web gui window (jump_handle). Pinging keeps running meanwhile."""
         rows, cols = screen.getmaxyx()
         dw = min(76, max(40, cols - 4))
-        dh = 18
+        dh = 19
         dy = max(0, rows // 2 - dh // 2)
         dx = max(0, cols // 2 - dw // 2)
-        labels  = ['HOST', 'PORT', 'USER', 'PASSWORD', 'HOST KEY', 'KEY FILE']
-        keys    = ['host', 'port', 'user', 'secret', 'hostkey', 'key']
+        labels  = ['HOST', 'PORT', 'USER', 'PASSWORD', 'HOST KEY', 'NAMES', 'KEY FILE']
+        keys    = ['host', 'port', 'user', 'secret', 'hostkey', 'resolve', 'key']
         vals    = [_jump_last.get('host', ''), _jump_last.get('port', ''), _jump_last.get('user', ''),
-                   '', _jump_last.get('hostkey', 'accept-new'), _jump_last.get('key', '')]
+                   '', _jump_last.get('hostkey', 'accept-new'),
+                   'on' if _jump_last.get('resolve', True) else 'off', _jump_last.get('key', '')]
+        nm_text = {'on': 'resolve on the jump host', 'off': 'resolve locally'}
         hk_text = {'ask': 'ask (confirm unknown key)', 'accept-new': 'accept new hosts', 'off': 'OFF - no check (insecure)'}
         pre     = ssh_prereq()
         status  = ['']
@@ -8618,11 +8851,13 @@ if __name__=='__main__':
             screen_output(dy + 3, dx, '│' + (' ' + info)[:dw - 2].ljust(dw - 2) + '│', cls, 0)
             fw = dw - 16
             for i, lab in enumerate(labels):
-                shown = ('*' * len(vals[i])) if keys[i] == 'secret' else (hk_text[vals[i]] + '  [ENTER/SPACE=change]' if keys[i] == 'hostkey' else vals[i])
+                shown = ('*' * len(vals[i])) if keys[i] == 'secret' else (
+                    hk_text[vals[i]] + '  [ENTER/SPACE=change]' if keys[i] == 'hostkey' else
+                    nm_text[vals[i]] + '  [ENTER/SPACE=change]' if keys[i] == 'resolve' else vals[i])
                 shown = shown[-fw:] if len(shown) > fw else shown
                 line = ' ' + lab.ljust(10) + (shown + '_' * 0).ljust(fw) + ' '
                 screen_output(dy + 4 + i, dx, '│' + line[:dw - 2].ljust(dw - 2) + '│', 2 if focus == i else 1, 1 if focus == i else 0)
-            screen_output(dy + 10, dx, '│' + ' ' * (dw - 2) + '│', 1, 0)
+            screen_output(dy + 11, dx, '│' + ' ' * (dw - 2) + '│', 1, 0)
             lines = []
             for t in status:
                 lines.extend(wrap(t, dw - 4))
@@ -8630,18 +8865,18 @@ if __name__=='__main__':
                 lines.extend(wrap(f, dw - 4))
             for i in range(4):
                 txt = lines[i] if i < len(lines) else ''
-                screen_output(dy + 11 + i, dx, '│' + (' ' + txt)[:dw - 2].ljust(dw - 2) + '│', status_cls, 0)
+                screen_output(dy + 12 + i, dx, '│' + (' ' + txt)[:dw - 2].ljust(dw - 2) + '│', status_cls, 0)
             bl = buttons()
             col = dx + 2
-            screen_output(dy + 15, dx, '│' + ' ' * (dw - 2) + '│', 1, 0)
+            screen_output(dy + 16, dx, '│' + ' ' * (dw - 2) + '│', 1, 0)
             for i, (name, _a) in enumerate(bl):
                 lab = ' [' + name + '] '
                 hi = (focus == len(labels) + i)
-                screen_output(dy + 15, col, lab, 2 if hi else 1, 1 if hi else 0)
+                screen_output(dy + 16, col, lab, 2 if hi else 1, 1 if hi else 0)
                 col += len(lab) + 1
-            screen_output(dy + 16, dx, '│' + ' TAB/arrows=move  ENTER=select  ESC=close'.ljust(dw - 2) + '│', 1, 0)
-            screen_output(dy + 17, dx, '└' + '─' * (dw - 2) + '┘', 1, 1)
-            if focus < len(labels) and keys[focus] != 'hostkey' and not busy['t']:
+            screen_output(dy + 17, dx, '│' + ' TAB/arrows=move  ENTER=select  ESC=close'.ljust(dw - 2) + '│', 1, 0)
+            screen_output(dy + 18, dx, '└' + '─' * (dw - 2) + '┘', 1, 1)
+            if focus < len(labels) and keys[focus] not in ('hostkey', 'resolve') and not busy['t']:
                 curses.curs_set(1)
                 shown_len = min(len(vals[focus]), fw)
                 screen.move(dy + 4 + focus, dx + 12 + shown_len)
@@ -8713,6 +8948,8 @@ if __name__=='__main__':
                     focus = (focus - 1) % nfocus
                 elif ch in (10, 13, 32) and focus < len(labels) and keys[focus] == 'hostkey':
                     vals[focus] = SSH_HOSTKEY_MODES[(SSH_HOSTKEY_MODES.index(vals[focus]) + 1) % 3]
+                elif ch in (10, 13, 32) and focus < len(labels) and keys[focus] == 'resolve':
+                    vals[focus] = 'off' if vals[focus] == 'on' else 'on'
                 elif ch in (10, 13):
                     if focus < len(labels):
                         focus = (focus + 1) % nfocus
@@ -8724,7 +8961,7 @@ if __name__=='__main__':
                             status, status_cls = [pre['hint']], 3
                         else:
                             start(act)
-                elif focus < len(labels):
+                elif focus < len(labels) and keys[focus] not in ('hostkey', 'resolve'):
                     if ch in (curses.KEY_BACKSPACE, 127, 8):
                         vals[focus] = vals[focus][:-1]
                     elif 32 <= ch <= 126 and len(vals[focus]) < 255:
@@ -9520,7 +9757,8 @@ if __name__=='__main__':
                 gn_thread, gn_result, gn_candidates = get_names_start(
                     original_hosts_list, int(args.dns_ttl))
                 if gn_thread is None:
-                    notice('GET NAMES: NO ELIGIBLE IP HOST(S)', 2, 3)
+                    notice('GET NAMES: NOT AVAILABLE VIA JUMP HOST' if (ssh_target and not jr_active())
+                           else 'GET NAMES: NO ELIGIBLE IP HOST(S)', 2, 3)
                     message = 'get names: no eligible ip host(s)'
                 else:
                     notice('GET NAMES: RUNNING IN BACKGROUND (%d HOST(S))'
@@ -9773,6 +10011,7 @@ if __name__=='__main__':
     hosts_count_up = 0
     hosts_count_down = 0
     hosts_count_flap  = 0
+    hosts_count_shown = 0
     run_time       = '0.00'
     phase          = {}
     used_scan      = ''
@@ -9826,7 +10065,7 @@ if __name__=='__main__':
         # mirror the same fix as run_web_mode(): HOSTS-UP/DOWN in the web view should
         # be the totals for the current view, not narrowed by the [M] display filter
         # the way the curses screen's own hosts_count_up/down are (left untouched here).
-        total_list = build_display(view_hosts(filter_mode, active_hosts_list, host_state, tz_offset, flap_window), host_state, sort_mode,
+        total_list = build_display(active_hosts_list, host_state, sort_mode,
                                    tz_offset, flap_window)
         total_up   = sum(1 for e in total_list if 'UP' in e[1])
         total_down = len(total_list) - total_up
@@ -9855,17 +10094,20 @@ if __name__=='__main__':
         so they can take effect at once instead of after the next scan round.
         """
         global display_list, hosts_count_up, hosts_count_down, hosts_count_flap
-        display_list = build_display(view_hosts(filter_mode, active_hosts_list, host_state, tz_offset, flap_window), host_state, sort_mode,
-                                     tz_offset, flap_window)
-        # HOSTS/UP/DOWN/FLAPPING are the totals of the whole view - [M] and ADV FILTER
-        # only narrow what is shown, every host is still pinged
+        global hosts_count_shown
+        display_all = build_display(active_hosts_list, host_state, sort_mode,
+                                    tz_offset, flap_window)
+        # HOSTS/UP/DOWN/FLAPPING count all hosts - the view, [M] and ADV FILTER only
+        # narrow what is shown (SHOWN), every host is still pinged
         _now_ref = now_local(tz_offset)
-        hosts_count_up   = sum(1 for e in display_list if 'UP' in e[1])
-        hosts_count_down = len(display_list) - hosts_count_up
-        hosts_count_flap = sum(1 for e in display_list
+        hosts_count_up   = sum(1 for e in display_all if 'UP' in e[1])
+        hosts_count_down = len(display_all) - hosts_count_up
+        hosts_count_flap = sum(1 for e in display_all
                                if host_is_flapping(e, _now_ref, flap_window))
+        display_list = view_rows(display_all, filter_mode, host_state, tz_offset, flap_window)
         if match_filter_re is not None or adv_filter:
             display_list = apply_match_filter(display_list, match_filter_re)
+        hosts_count_shown = len(display_list)
 
     def draw_screen():
         """Paint the whole screen from the data of the last completed round.
@@ -9985,11 +10227,13 @@ if __name__=='__main__':
         screen_output(rows - 1, 67, 'DOWN: ', 1, 1)
         screen_output(rows - 1, 73, hosts_down, 3, 1)
         screen_output(rows - 1, 79, 'FLAPPING: ', 1, 1)
-        screen_output(rows - 1, 89, hosts_flap.rstrip() + ' |', 1, 1)
+        screen_output(rows - 1, 89, hosts_flap.rstrip(), 1, 1)
+        screen_output(rows - 1, 96, 'SHOWN: ', 1, 1)
+        screen_output(rows - 1, 103, ('{m: <6}'.format(m=hosts_count_shown)).rstrip() + ' |', 1, 1)
         if args.disable_logging:
-            screen_output(rows - 1, 99, 'LOGGING-ON: ' + logfile_file_name, 1, 1)
+            screen_output(rows - 1, 113, 'LOGGING-ON: ' + logfile_file_name, 1, 1)
         else:
-            screen_output(rows - 1, 99, 'LOGGING-OFF', 1, 1)
+            screen_output(rows - 1, 113, 'LOGGING-OFF', 1, 1)
         if num_of_hosts > 0 and maxhosts < num_of_hosts:
             tts_text = ' | TERMINAL TOO SMALL '
             screen_output(rows - 1, cols - len(tts_text), tts_text, 3, 2)
@@ -10292,7 +10536,8 @@ if __name__=='__main__':
                 gn_thread, gn_result, gn_candidates = get_names_start(
                     original_hosts_list, int(args.dns_ttl))
                 if gn_thread is None:
-                    notice('GET NAMES: NO ELIGIBLE IP HOST(S)', 2, 3)
+                    notice('GET NAMES: NOT AVAILABLE VIA JUMP HOST' if (ssh_target and not jr_active())
+                           else 'GET NAMES: NO ELIGIBLE IP HOST(S)', 2, 3)
                 else:
                     notice('GET NAMES: RUNNING IN BACKGROUND (%d HOST(S))'
                           % len(gn_candidates), 2)

{eping-4.1 → eping-4.4}/src/eping.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: eping
-Version: 4.1
+Version: 4.4
 Summary: Continuous ICMP reachability monitor built on fping, with a CSV logfile analyser (epinga)
 Author-email: Ewald Jeitler <ewald@jeitler.cc>
 License: GPL-3.0-or-later
@@ -17,7 +17,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Dynamic: license-file
 
-# eping.py 4.01
+# eping.py 4.04
 
 Continuous ICMP reachability monitor built on `fping`. Scans a host list in a loop,
 reports each host UP/DOWN/NO-DNS, counts state changes. CLI (curses) or web GUI.
@@ -235,8 +235,8 @@ Single self-contained page, no external resources.
 
 - Table: CLI-style columns, filled top-down then next column right. Horizontal scroll
   if needed ("SCROLL RIGHT FOR MORE" hint in the stats bar).
-- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING, for the whole current view regardless
-  of the match filter and the ADV FILTER (HOSTS-SHOWN = shown count). The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
+- Footer stats: HOSTS, RUNTIME, HOST UP/DOWN/FLAPPING always count all hosts; SHOWN is the
+  number of rows displayed after the view, the match filter and the ADV FILTER. The CLI footer counts the same way. RUNTIME shows `n/a` briefly during a background round.
 - Adding many hosts (`ADD`, ADD HOSTS FILE, upload) shows "added N host(s) - please wait,
   pinging ..." until they appear with a state, then `done`.
 - Font size 6–28px (slider, `A−`/`A+`, `+`/`−` keys), stored in `localStorage`.
@@ -449,6 +449,7 @@ separated) · `-r` IP range (comma separated, shortened end)
 | `-ssh` | `[USER@]HOST[:PORT]` | off | run fping on a jump host via ssh (see *SSH source (JUMPHOST)*) |
 | `-sshkey` | file | agent | private key file for `-ssh` |
 | `-sshhk` | accept-new/ask/off | accept-new | host key check for `-ssh` |
+| `-sshnr` | — | off | with `-ssh`: do not resolve names on the jump host (use the local resolver) |
 | `-ncf` | — | off | CSV: do not ping the CSV IP of a name without DNS record |
 | `-up` | — | 0 | learning phase: after N rounds show only hosts seen UP (view CURRENTLY-UP; all hosts are still pinged until SET REFERENCE) |
 | `-setref` | — | off | with `-up`: hosts seen UP become new reference list |
@@ -509,24 +510,31 @@ these rows automatically.
 ## SSH source (JUMPHOST)
 
 Run fping on a jump host instead of locally (system `ssh` only). Any Linux host with a working `fping`
-(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`);
+(e.g. a caretaker) will do; it resolves the names itself. Start: `-ssh [USER@]HOST[:PORT]` (+ `-sshkey FILE`, `-sshhk MODE`, `-sshnr`);
 the password or key passphrase is asked on the terminal at startup. At runtime: `J` in the CLI,
 JUMPHOST button in the web GUI (after ADV OPTIONS).
 
 ![JUMPHOST window](https://raw.githubusercontent.com/ewaldj/eping/main/docs/img/jumphost.png)
 
-- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, KEY FILE. TEST checks ssh, login and
+- Window: HOST, PORT, USER, PASSWORD (key passphrase), HOST KEY, NAMES, KEY FILE. TEST checks ssh, login and
   fping on the jump host, CONNECT switches the scan source, USE LOCAL switches back. A missing local
   `ssh` is shown in the window.
 - HOST KEY: `accept-new` (default) - hosts seen for the first time are trusted automatically, a changed
   key is still refused; `ask` - an unknown key is shown with its fingerprint and must be accepted with
   TRUST KEY; `off` - no check at all (insecure).
+- NAMES (default on): the DNS lookups eping does itself - GET NAMES, PREFER HOSTNAME / IP ADDRESS, IP ONLY -
+  run on the jump host over the same ssh connection (no second login), using `getent`, else `dig`,
+  `nslookup` or `host` there; TEST/CONNECT report which tool works. One batch per call, names are validated
+  and sent via stdin. Without a working tool, or with the option off (`-sshnr`), the local resolver is used
+  and GET NAMES is not available. The DNS caches are cleared on every source switch.
+  A name with only an AAAA record is pinged with `fping -6` there (A is preferred, as locally). Without a resolver on
+  the jump host, a name that fping reports as NO-DNS is tried with `-6` in the next round, alternating with `-4`; `-4` / `-6` force one family.
 - The switch is applied at the start of the next round; hosts, states and counters are kept.
 - Connection loss: results of the round are discarded, hosts keep their state, a banner is shown and
   eping reconnects. Logged as `#COMMENT#` rows (`JUMPHOST ... OFFLINE: <reason>`, `JUMPHOST ... ONLINE
   again`, `SOURCE SWITCH <old> -> <new>`), shown in the report's comment timeline.
 - Log column `SOURCE`: `local` or the jump host of each row.
-- Limits: GET NAMES and the CSV-IP fallback are not available over ssh; at most 4 ssh processes
+- Limits: the CSV-IP fallback is not available over ssh; at most 4 ssh processes
   (2 on Windows); the web password transfer is plain HTTP - use `-bind 127.0.0.1` or a trusted network.
 
 ## Web GUI header