Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5774] Wireshark unnecessarily restricts the number of NetF

Date: Wed, 13 Apr 2011 13:52:32 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5774

--- Comment #3 from Andrew Feren <acferen@xxxxxxxxx> 2011-04-13 13:52:31 PDT ---
You make a reasonable point about memory allocation.

I suspect that the original value of 20 was simply big enough to hold the
equivalent fields as were in previous version of NetFlow 

v1 : 13
v5 : 18
v7 : 19
v8 : Various < 20

Increases after that were most likely enough to meet whatever new need came up.
 That was what I did when I submitted the patch to bring it to 42 (which was
bigger than the exporter I was dealing with at the time could ever send)


There is no real upper bound in the protocol, but I suspect that we are
approaching the limit of what people are likely to send.  (of course I have
thought that before :-)

If you make the new limit 100 I know I'll be all set for a while.

Maybe I'll submit an other patch to make the upper limit a user pref.  Then if
someone needs more fields for some reason they could still decode their data
without needing to patch wireshark.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.