Ethereal-users: Re: [Ethereal-users] display filter problem...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Thu, 19 Jan 2006 17:52:41 -0800
At 03:14 PM 1/19/2006, Gerald Combs wrote:
Jack Jackson wrote:
>
> The only thing that is slow is when digits are entered.  I can enter any
> number of non-digit characters and there is no delay.  A delay occurs as
> soon as I type the first digit after the ==.  See my previous message
> for a detailed explanation of when I see the delay.
>
> It does NOT happen for me in 0.10.12 (I don't have 0.10.13 installed).

Can you try build 17056 or later from
http://www.ethereal.com/distribution/buildbot-builds/win32/?  I just
checked in a change that might help.

Thanks, that fixes the delays when an IP address is entered.

Both 0.10.13 and .14-17056 do DNS lookups for each character typed when the data after the == does not appear to be an IP address, regardless of whether or not DNS resolution is enabled. I'm not sure but I suspect it is correct that name resolution should happen here regardless of the preferences, since there is no point in entering a DNS name here unless it can be resolved.

There is an issue here for OSes that have NetBIOS over TCP enabled (probably only Windows) - on my XP machine each unsuccessful name resolution tries three ways: DNS query, then a WINS query, then several NetBIOS Name Service broadcasts (the delays come from waiting for a response to the broadcasts). Turning off NetBIOS over TCP gets rid of the delays, and I suspect that is the only viable solution.

Maybe there should be something in the Wiki about NetBIOS over TCP - I looked but wasn't sure where it should go.