On 09/16/13 16:04, Guy Harris wrote:
On Sep 16, 2013, at 12:44 PM, Anders Broman <[email protected]> wrote:
I got rid of getservbyport() and added reading of the local services file
perhaps the read should be removed again?
"Local services file" as in "/etc/services" on UN*X and its equivalent on Windows
(C:\winnt\system32\drivers\etc\services?), or "local services file" as in "the services file that's distributed as
part of Wireshark"? We should continue to use the latter; the aforementioned "modifications for local use" could
be made to that file as well.
I'm also wondering if service name resolution should be defaulted to off, I'm
not convinced it's that useful.
Using the IANA port list is the reason why we get people asking why, for example, they're
seeing "dssiapi" traffic on their network, just because something happens to be
using port 1265. (I picked that example somewhat at random, but we *do* get that asked
at times.)
Should we, instead, look the port number up in the "tcp.port" or "udp.port" (or
"sctp.port") dissector table and, if it finds a dissector handle, look up the short name of the
protocol for that dissector handle and use that? That means that:
1) we're using the name Wireshark uses elsewhere for the protocol (e.g., "DNS"
rather than "domain");
2) if we don't have a dissector registered for that port, we don't show
a protocol name (which is arguably a feature rather than a bug, as the traffic
isn't necessarily for the protocol linked with the port number given in the
IANA list, and this means that if we're not going to dissect the traffic as
that protocol we're probably not going to claim it's that protocol, which I see
as a Good Thing).
If we decide to have it default off perhaps we shouldn't default to write
User Datagram Protocol, Src Port: 60000 (60000), Dst Port: 13868 (13868) but
rather
User Datagram Protocol, Src Port: 60000 , Dst Port: 13868
Yes, and the same applies for network addresses, if we're not already doing
that.
Defaulted to off (i.e., a preference) or off by code?
If we have a preference (for services or network addresses) I think
keeping the same format:
User Datagram Protocol, Src Port: 60000 (60000), Dst Port: 13868 (13868)
is actually a good thing because then tshark output parsers don't have
to worry about whether or not the preference is set.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
