Wireshark has transport name resolution enabled by default. Unfortunately protocol numbers often get mapped to the wrong name, which can lead to confusion:
https://ask.wireshark.org/questions/10380/what-is-commplex-main It seems like the "services" file has effectively become "a list of things not running on the network". This is especially true for OSes that use the old-style (1024 - 4999) ephemeral port range. Is there any reason we shouldn't disable transport name resolution by default for the 1.8 release? -- Join us for Sharkfest ’12! · Wireshark® Developer and User Conference Berkeley, CA, June 24-27 · sharkfest.wireshark.org ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
