Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 18935: /trunk/epan/ /trunk/epan/diss

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Thu, 17 Aug 2006 11:53:02 +0200
ronnie sahlberg wrote:
we now have pe_tree_...., with permanent allocation scope.
A permanent scope may not be right for all kinds of UUIDs/GUIDs, as some of them will be generated dynamically in the protocol machine.

I know of the IPID in DCOM (which has the same meaning as the optional Object UUID in DCE/RPC) is dynamically that way: Resolvings had to be generated while the capture file is loaded and probably thrown away after the capture file is closed :-) However, keeping this data even if the capture file is closed might be an option, so pe_tree would be the way to go.

Using the GHashTable would have the advantage that both "static" and dynamic data were possible.

I don't know the access times of the GHashTable and the pe_tree which might also be a point to consider if the "tables" become large.
we should use them for guid->name mappings instead of a hashtable.
(and add a file holding global wellknown mappings like manuf does for
well known ethernet prefixes)
Do we need a file for these mappings instead of simply hard coding it? Are there UUID's that has to be user defined?

However, as it's certainly more work to implement the file handling, it may be a better solution in the long term.


Both points are currently blur to me, don't know which will be the right way to go.

Regards, ULFL

P.S: Thanks for the WIN32 bracket correction!