Re: Ethereal Crash

[Phil Knirsch]

Essam Mohsin wrote:
>  Hi :
>   
>  I run Fedora Core2 Test3 on a PC " Intel PIV 1.GHz , 512 MB RAM , IDE 
>  HDD 10GB , nVidia Riva TNT2 VGA , 3Com 3C905 Network Card " . when I try 
>  to run Ethereal 0.10.3 and tick on the "Enable network name resolution" 
>  on the "Capture Options" , it will run for few seconds then it will stop 
>  scrolling the view of packets , then part of the display is blanked to 
>  white color , when I try to close it from the cross at the top of the 
>  screen it will take 5 minutes with no response then an error message 
>  will popup telling that " Window with the title " The Ethereal Network 
>  Analyzer" is not responding this window belong to the application 
>  ethereal (PID=xxxx , hostname=localhost) . Do you wish to terminate the 
>  app ...... "
>   
>  Please note that I use my ISP DNS server IP to resolve the addresses of 
>  internet hosts , and I don't have local DNS server on my network . And 
>  Ethereal works fine when this option is not selected
>    
Well, the problem is simple: The DNS lookups just take way too long for 
ethereal if there are tons of packages going in and out.

I've done the same test here on my box on our LAN and with that option 
enabled it took about 1 minute on my PIV 3GHz dual machine with both 
CPUs at top load to get all the info sorted.

So on a smaller box i can easily take quite some time. My simple advice: 
Don't turn that option on. It's similar to apache and the DNS resolution 
(which is a big nono in any sane apache setup that gets more than a few 
hundred hits a day).

Read ya, Phil

-- 
Philipp Knirsch      | Tel.:  [phone]
Development          | Fax.:  [phone]
Red Hat GmbH         | Email: Phil Knirsch <phil(a)redhat.de&gt;
Hauptstaetterstr. 58 | Web:   http://www.redhat.de/
D-70178 Stuttgart
Motd:  You're only jealous cos the little penguins are talking to me.