Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Transport name resolution

From: Anders Broman <a.broman@xxxxxxxxxxxx>
Date: Mon, 16 Sep 2013 21:44:34 +0200
Jeff Morriss skrev 2013-09-16 21:17:
On 09/16/13 14:57, Guy Harris wrote:

On Sep 16, 2013, at 7:20 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:

In serv_name_lookup() we call getservbyport() for ports not resolved in the IANA port list the function Seems quite expensive so my question is does it add any value or can I remove it?

At least on UN*Xes, getservbyport() does one or more of:

1) look in /etc/services, which is probably based on a (possibly-out-of-date) version of, err, umm, the IANA port list;

2) query some network service to do a lookup - and that service is probably using its own database, based on a (possibly-out-of-date) version of, err, umm, the IANA port list.

... possibly with some modifications for local use. But I imagine the number of people who actually go through the trouble to run a customized service database to be sufficiently few that it's not worth slowing everyone else down for.
I got rid of getservbyport() and added reading of the local services file perhaps the read should be removed again? I'm also wondering if service name resolution should be defaulted to off, I'm not convinced it's that useful.

If we decide to have it default off perhaps we shouldn't default to write
User Datagram Protocol, Src Port: 60000 (60000), Dst Port: 13868 (13868) but rather
User Datagram Protocol, Src Port: 60000 , Dst Port: 13868

Regards
Anders

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe