Wireshark · Ethereal-dev: Re: [Ethereal-dev] Etheral 0.10.4 Suggestions and Thoughts.

["Martin Regner" <martin.regner@xxxxxxxxx>]

Guy Harris wrote:
> On Mon, May 17, 2004 at 01:01:00PM -0500, Alan Jones wrote:
> 

> 
> If you're referring to name resolution for IP addresses, Ethereal either
> 
> 1) uses the native OS's "gethostbyaddr()" function
> 

> 
> 2) uses GNU ADNS
> 
> to resolve IPv4 addresses, and uses "gethostbyaddr()" to resolve IPv6

If you load a capture with DNS packets in it then the DNS
 packets can also be used when resolving ip-addresses to names
and similar.

The DNS dissector will use add_host_name(...) or something to put the
entries in a name resolution table.

I have an other observation I made with the new Statistic/Conversation.

I tried the new Statistic/Conversation functionality in 0.10.4 
with a SIP+DNS capture I had got from someone on the list.
It was captured in a 10.x.x.x network.

I noticed that I didn't get ip-address translated to names 
when I had "Name resolution" turned on in Statistics/Conversations
 (IP/TCP/UDP), but many ethernet addresses was translated into
 real names whenI had "Name resolution" turned on in 
Statistics/Conversations (Ethernet).

Later I noticed that I had network name resolution turned off in 
Edit/Preferences../Name resolution/Network name resolution.

If I turned it on almost all of the 10.x.x.x addresses was translated
into corresponding names in Statistucs/Conversation.

The reason why Ethernet addresses was translated into real host names
was that "Enable mac name resolution" had been turned on all the time.

Maybe the "Name resolution" checkbox in Statistics/Conversations 
(IP/TCP/UDP) should be grayed out if "Network name resolution" is turned
off in in Edit/Preferences.../Name resolution, 
and maybe "Name resolution" checkbox in Statistics/Conversation 
(Ethernet) should be grayed out if "Enable mac name resolution" is
turned off  in Edit/Preferences.../Name resolution.