Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 18935: /trunk/epan/ /trunk/epan/dissectors/: packet-dcer

[Ulf Lamping <ulf.lamping@xxxxxx>]

ronnie sahlberg wrote:
> we now have pe_tree_...., with permanent allocation scope.
>   
A permanent scope may not be right for all kinds of UUIDs/GUIDs, as some 
of them will be generated dynamically in the protocol machine.

I know of the IPID in DCOM (which has the same meaning as the optional 
Object UUID in DCE/RPC) is dynamically that way: Resolvings had to be 
generated while the capture file is loaded and probably thrown away 
after the capture file is closed :-) However, keeping this data even if 
the capture file is closed might be an option, so pe_tree would be the 
way to go.

Using the GHashTable would have the advantage that both "static" and 
dynamic data were possible.

I don't know the access times of the GHashTable and the pe_tree which 
might also be a point to consider if the "tables" become large.
> we should use them for guid->name mappings instead of a hashtable.
> (and add a file holding global wellknown mappings like manuf does for
> well known ethernet prefixes)
>   
Do we need a file for these mappings instead of simply hard coding it? 
Are there UUID's that has to be user defined?

However, as it's certainly more work to implement the file handling, it 
may be a better solution in the long term.


Both points are currently blur to me, don't know which will be the right 
way to go.

Regards, ULFL

P.S: Thanks for the WIN32 bracket correction!