On 09/16/13 16:04, Guy Harris wrote:
On Sep 16, 2013, at 12:44 PM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:
I got rid of getservbyport() and added reading of the local services file perhaps the read should be removed again?
"Local services file" as in "/etc/services" on UN*X and its equivalent on Windows (C:\winnt\system32\drivers\etc\services?), or "local services file" as in "the services file that's distributed as part of Wireshark"? We should continue to use the latter; the aforementioned "modifications for local use" could be made to that file as well.
I'm also wondering if service name resolution should be defaulted to off, I'm not convinced it's that useful.
Using the IANA port list is the reason why we get people asking why, for example, they're seeing "dssiapi" traffic on their network, just because something happens to be using port 1265. (I picked that example somewhat at random, but we *do* get that asked at times.)
Should we, instead, look the port number up in the "tcp.port" or "udp.port" (or "sctp.port") dissector table and, if it finds a dissector handle, look up the short name of the protocol for that dissector handle and use that? That means that:
1) we're using the name Wireshark uses elsewhere for the protocol (e.g., "DNS" rather than "domain");
2) if we don't have a dissector registered for that port, we don't show a protocol name (which is arguably a feature rather than a bug, as the traffic isn't necessarily for the protocol linked with the port number given in the IANA list, and this means that if we're not going to dissect the traffic as that protocol we're probably not going to claim it's that protocol, which I see as a Good Thing).
If we decide to have it default off perhaps we shouldn't default to write
User Datagram Protocol, Src Port: 60000 (60000), Dst Port: 13868 (13868) but rather
User Datagram Protocol, Src Port: 60000 , Dst Port: 13868
Yes, and the same applies for network addresses, if we're not already doing that.
Defaulted to off (i.e., a preference) or off by code?
If we have a preference (for services or network addresses) I think
keeping the same format:
User Datagram Protocol, Src Port: 60000 (60000), Dst Port: 13868 (13868)
is actually a good thing because then tshark output parsers don't have
to worry about whether or not the preference is set.
