On Nov 19, 2025, at 6:53 AM, Anders Broman <a.broman58@xxxxxxxxx> wrote:
> Should heuristic (udp/tcp) be default off to speed up dissection of larger files? Or
> should we just disable the more unusual ones?
I'd vote for "disable the more unusual ones" - or "have profiles that disable the ones unlikely to be used in that context".
ONC RPC, for example, has some pretty good heuristics, and, at least at one point, was fairly common, even for protocols that, unlike portmap/NFS, don't have ports assigned to them (e.g., YP/NIS). I'd leave that one enabled.
Do we have any numbers on how much of a performance improvement results form disabling all heuristics?