On Thu, Jan 25, 2001 at 10:06:29PM +0800, Jonathan Anand Fernandes wrote:
> I haven't used Ethereal for about 2/3 weeks, but I am a bit confused
> by the fact that Ethereal seems to be "hanging". Someone else seemed to
> have had the same problem earlier this month, with the "loading
> etherXXXX" window.
What happens if, when you run Ethereal from the command line, you also
pass it the "-n" option, or, if you don't run Ethereal from the command
line (say, you run it from a GUI menu or desktop icon):
when you load a file using the "File->Open" menu item, you turn
off the the "Enable name resolution" option in the "Open Capture
File" dialog box (in the default GTK+ theme, that option is
recessed when on and raised when off; I think GTK+ 2.0 will go
with a more Windows-like and less Motif-like behavior in the
future, with a check mark present if it's on and absent if it's
off);
when you run a capture from the "Capture->Start" menu item, you
turn off the "Enable name resolution" option in the "Capture
Preferences" dialog box.
If that fixes the problem, the problem is that there's some IP address
in your capture that, to be converted to a host name, requires talking
to a DNS server that's not responding; eventually, the attempt to do so
times out, and the application will presumably give up and just report
the IP address as itself rather than as the corresponding name, but that
can take a while.
> I find it strange because :
> 1. 3 weeks ago I had no problems with Ethereal hanging
Sometimes DNS servers Just Stop Working. (Heck, *Microsoft's* DNS
servers were apparently down yesterday - and I don't mean "the DNS
server code that comes with Windows NT/2000", I mean "the DNS server
machines that were handling the 'microsoft.com' domain"; even Large
Corporate Entities can lose DNS service....) Then they'll often start
working again at some point later.
> 2. I am working on a private LAN, when I do 'ping' captures using Ethereal
> there seems to be no problem, however when using "real" data from the main
> school network, Ethereal hangs. (I am not sure how relevant this
> observation is)
The machines on the main school network might be talking to hosts on
other networks, so that you'd have to use a DNS server outside your
network to find out the name for the IP addresses in the packets, but
your "ping" captures may be to hosts whose names *can* be resolved
through working DNS servers (if you "ping"ed them by host name, that's
likely to be the case, although the reverse lookup *might* involve a
different server from the one the forward lookup used).
