Wireshark · Ethereal-users: Re: [Ethereal-users] display filter problem...

[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 03:14 PM 1/19/2006, Gerald Combs wrote:
> Jack Jackson wrote:
> >
> > The only thing that is slow is when digits are entered.  I can enter any
> > number of non-digit characters and there is no delay.  A delay occurs as
> > soon as I type the first digit after the ==.  See my previous message
> > for a detailed explanation of when I see the delay.
> >
> > It does NOT happen for me in 0.10.12 (I don't have 0.10.13 installed).
>
> Can you try build 17056 or later from
> http://www.ethereal.com/distribution/buildbot-builds/win32/?  I just
> checked in a change that might help.

Thanks, that fixes the delays when an IP address is entered.

Both 0.10.13 and .14-17056 do DNS lookups for each character typed when the 
data after the == does not appear to be an IP address, regardless of 
whether or not DNS resolution is enabled.  I'm not sure but I suspect it is 
correct that name resolution should happen here regardless of the 
preferences, since there is no point in entering a DNS name here unless it 
can be resolved.

There is an issue here for OSes that have NetBIOS over TCP enabled 
(probably only Windows) - on my XP machine each unsuccessful name 
resolution tries three ways:  DNS query, then a WINS query, then several 
NetBIOS Name Service broadcasts (the delays come from waiting for a 
response to the broadcasts).  Turning off NetBIOS over TCP gets rid of the 
delays, and I suspect that is the only viable solution.

Maybe there should be something in the Wiki about NetBIOS over TCP - I 
looked but wasn't sure where it should go.