Wireshark-dev: Re: [Wireshark-dev] About transport name resolution with the new services file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Abhik Sarkar" <sarkar.abhik@xxxxxxxxx>
Date: Sat, 18 Aug 2007 18:27:07 +0400
+1 for that idea :)

On 8/18/07, Richard van der Hoff <richardv@xxxxxxxxxxxxx> wrote:
> On Sat, 18 Aug 2007, Francois-Xavier Le Bail wrote:
>
> > Hi List,
> >
> > In version 0.99.6 we have, by example :
> > Source   Destination   Protocol Info
> > 10.0.0.2 62.210.65.158 TCP      3946 > http [ACK] ...
> >
> > In version 0.99.7-SVN-22549 we have :
> > Source   Destination   Protocol Info
> > 10.0.0.2 62.210.65.158 TCP      backupedge > http
> > [ACK] ...
> >
> > The resolution from the new services file from IANA is
> > not relevant in such cases with random source port.
> > Perhaps this new resolution scheme should be optional.
>
> Perhaps it should just be more intelligent, and if one port is < 1024 and
> the other isn't, just resolve the one less than 1024?
>
> On the other hand that doesn't solve the problem in the general case. I
> guess it would be nice to make a decision based on where the SYN comes
> from.
>
>
> --
> Richard van der Hoff <richardv@xxxxxxxxxxxxx>
> Systems Analyst
> Tel: +44 (0) 845 666 7778
> http://www.mxtelecom.com
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>