Wireshark · Ethereal-users: Re: [Ethereal-users] name resolution cache?

[Guy Harris <guy@xxxxxxxxxx>]

> Is there a way to make Ethereal cache the addresses it has already resolved?

It *does* include code to do that; that code even caches failures.

> I loaded a trace of a udp flood, with 62,000+ packets with the same 
> source and destination address.  Ethereal tried to resolve the 
> addresses for each and every packet, even though they were identical.

Are you certain of that?  If it's not caching both successes and
failures, that's a bug.
> 
> Needless to say, it would have taken forever, so I canceled and 
> re-opened it with name resolution disabled.  It opened in a matter of 
> seconds after that!

Note that the fact that disabling name resolution doesn't *ipso facto*
demonstrate that the problem is that it was trying to resolve the
address for each packet; it could only mean that one of them was very
slow to be resolved.