Wireshark · Wireshark-dev: Re: [Wireshark-dev] Remove duplication for resolved addresses

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

Hi,

2015-09-10 13:50 GMT+02:00 João Valverde <joao.valverde@xxxxxxxxxxxxxxxxxx>:

Hi list,

I proposed a change[1] to remove the duplication for resolved addresses (not necessarily using that code) in the UI:

  Src: 192.0.2.1, Dst: 192.0.2.2

Instead of:

  Src: 192.0.2.1 (192.0.2.1), Dst: 192.0.2.2 (192.0.2.2)

This change (rightfully) raised concerns that it would break backward compatibility for scripts parsing this output. Any thoughts on this?

Just thinking out loud but maybe 2.0 would be a good opportunity to change this (if indeed it is an improvement)?

If I understand the issue correctly I personally don't think this should be a stable interface anyway but of course I'm willing to be corrected on that.

Next step after this would be doing the same for port resolution...

Regards,

João V.

[1] https://code.wireshark.org/review/#/c/10203/

Just a random thought (as I'm far from being a script expert). In case only one of the 2 IP address is resolved, would it be harder to parse?

  Src: 192.0.2.1, Dst: localhost (127.0.0.1)

The "advantage" of current code (whether it is relevant or not is an exercise left to the reader) is that you will always find the IP address (or port number) within parenthesis, whatever your preference configuration. On the other side, it is not really pretty to the eye.

Cheers,

Pascal.