ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] cleanup_dissection() called both on cf_close and cf_open()

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Mon, 25 Mar 2013 12:37:15 -0700
On 3/24/13 7:37 AM, Anders Broman wrote:
> Hi,
> Looking into address resolution I found that the hosts file is read
> multiple times partly
> because it's part of cleanup_dissection() which is called both on
> cf_open() and cf_close().
> 
> Should cleanup_dissection() take an argument showing whether its a file
> open or file close
> operation and different measures taken at least when it comes to the
> host_name_lockup...?

This is partly my fault, resulting from switching to seasonal memory for
name resolution in r45511. We call se_free_all() a lot, which means
calling host_name_lookup_init() a lot. It might be better to use a
different allocator for resolved addresses or to delay reading any hosts
files somehow. Either way we need to make sure resolved addresses don't
leak from one capture to the next.