I have not looked closely into it - so it might not be necessary to use entryrdn. I thought it might be more efficient to use it. If you just use id2entry, you have to keep scanning it over and over, and starting over every time you need to read the next entry. Maybe not though, maybe you can just "search" it and not have to scan it sequentially when trying to find parents and entries. I'll leave that up to you to find out ;-)I see now, thank you both very much!Follow-up:
[1] Get entry from id2entry and use its ID
[2] Look in entryrdn for the parent of the ID
[3] Keep looking for parents, building the DN as you go along
Example:
[1] Get entry from id2entry: ID 6 --> "cn=Accounting Managers"
[2] Check entryrdn for "P<ID>". In this case it's "P6" which is "ou=Groups" with ID 3
[3] So find "P3", which is "dc=example,dc=com" with ID 1, and look for "P1". But there is no P1, so we stop the process/loop.
Why do we need to look at entryrdn for parent's id? Is it faster?
I mean the same information can be found in id2entry (?). Or this is not the case and dbscan does the exact same process you just described in order to print "parentid: X" for each entry when you do "dbscan -f id2entry.db"?
Thanks again,