Wireshark · Ethereal-users: Re: [Ethereal-users] cache DNS lookups

[Guy Harris <gharris@xxxxxxxxx>]

Florin Andrei wrote:
> When opening a big tcpdump file, if i tell Ethereal to resolve IP
> addresses to host names, sometimes it takes a very long time. It looks
> like Ethereal performs repeated DNS lookups on the same address.

Have you seen network traffic showing it doing so?

> Is there a way to cache the results internally, so that a lookup is not
> repeated over and over?

Yes, and there's code in Ethereal to do so, so it *shouldn't* be doing 
repeated lookups when reading a capture file.  If it's doing so, that's 
a bug - is it doing so, or is it just taking a long time to attempt to 
resolve a given IP address, either because it's doing a DNS lookup and 
the DNS server isn't responding, or because this is on Windows, it's 
doing a NetBIOS-over-TCP lookup, and the remote machine isn't responding 
(either because it's down or because it's not running any software that 
responds to NBNS packets).