Wireshark-bugs: [Wireshark-bugs] [Bug 8462] Manual name resolution not working

Date: Tue, 10 Sep 2013 19:22:30 +0000

Comment # 7 on bug 8462 from
(In reply to comment #5)
> Yes, but it is not quite so simple, since we want to avoid writing extra
> names to the NRB to avoid leaking information. If we just keep name
> resolution data for the lifetime of the file (across multiple dissections)
> then we can end up with stale data getting written to the NRB.
> 

You are thinkig of the case where we filter out packets and then write to a new
file and the NRB might have all IP addresses of the original file resolved?

We might offer the option off not dumping NRB:s and settle for this less
elegant "solution".

> It seems to me that the correct way to handle all cases is to associated
> name resolution data with each frame (in the frame_data perhaps) in addition
> to the global hash table. Then base the data in the NRBs according to the
> what is linked from each frame being written (as opposed to just writing
> everything in the hash table).

That might be costly in memory usage, on the other hand the fdata entry could
perhaps be used in the packet list and could be a pointer to the string in the
hastable. For tshark ther would be no gain.

> 
> So the frame_data resolutions are cleared on each dissection, but the hash
> table is never cleared. Then when manual resolution occurs, it gets added to
> the hash table, the packet is redissected, and the frame_data name list is
> rebuilt from scratch with only the new information.


You are receiving this mail because:
  • You are watching all bug changes.