Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Transport name resolution

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 16 Sep 2013 15:17:54 -0400
On 09/16/13 14:57, Guy Harris wrote:

On Sep 16, 2013, at 7:20 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:

In serv_name_lookup() we call getservbyport() for ports not resolved in the IANA port list the function
Seems quite expensive so my question is does it add any value or can I remove it?

At least on UN*Xes, getservbyport() does one or more of:

	1) look in /etc/services, which is probably based on a (possibly-out-of-date) version of, err, umm, the IANA port list;

	2) query some network service to do a lookup - and that service is probably using its own database, based on a (possibly-out-of-date) version of, err, umm, the IANA port list.

... possibly with some modifications for local use. But I imagine the number of people who actually go through the trouble to run a customized service database to be sufficiently few that it's not worth slowing everyone else down for.