Index: dsniff/core/service.py
===================================================================
--- dsniff/core/service.py	(revision 8)
+++ dsniff/core/service.py	(working copy)
@@ -4,8 +4,6 @@
 from dsniff.core import flow
 from dsniff.lib import net
 
-#import pyappid as appid
-
 # XXX - override some service definitions
 _services = {
     'aolmail':'tcp and dst port 80 and dst net 205.188.0.0/16',
@@ -15,76 +13,83 @@
     'hotmail':'tcp and dst port 80 and dst net 64.4.0.0/18',
     'lycosmail':'tcp and dst port 80 and dst net 208.36.123.0/24',
     'yahoomail':'tcp and dst port 80 and dst net 66.163.160.0/19 or 64.58.76.0/22 or 64.41.224.0/23',
+    'dns':'dst port 53',
     }
 
-class ServiceHandler(dsniff.Handler):
-    name = 'service'
-    auto = False
+try:
+    import appid
+    class ServiceHandler(dsniff.Handler):
+        name = 'service'
+        auto = False
 
-    def setup(self):
-        if self.auto:
-            self.subscribe('flow', 'tcp or udp', self.recv_flow)
-        else:
-            self._register = self.__proxy_register
-            self._unregister = self.__proxy_unregister
+        def setup(self):
+            if self.auto:
+                self.subscribe('flow', 'tcp or udp', self.recv_flow)
+            else:
+                self._register = self.__proxy_register
+                self._unregister = self.__proxy_unregister
 
-    def recv_flow(self, f):
-        if '_service' in f.save:
-            self.publish(f.save['_service'], f)
-            return
-        if f.state == flow.FLOW_START:
+        def recv_flow(self, f):
+            if '_service' in f.save:
+                self.publish(f.save['_service'], f)
+                return
+            if f.state == flow.FLOW_START:
+                for half in f.half.itervalues():
+                    half.save['_appid'] = appid.appid()
+                    half.save['_appid_buf'] = half.data or ''
+            app = (-1, 0)
             for half in f.half.itervalues():
-                half.save['_appid'] = appid.appid()
-                half.save['_appid_buf'] = half.data or ''
-        app = -1
-        for half in f.half.itervalues():
-            if half.data:
-                half.save['_appid_buf'] += half.data
-                app = half.save['_appid'].process(half.data)
-                if app != -1: # APPID_CONTINUE
-                    break
-        if app != -1:
-            event = appid.app_to_name(app).lower()
-            print 'appid match:', event
-            if event in self.callbacks:
-                f.save['_service'] = event
-                for half in f.half.itervalues():
-                    half.data = half.save.pop('_appid_buf')
-                    del half.save['_appid']
-                f.state = flow.FLOW_START
-                self.publish(event, f)
-                if f.client.data:
-                    f.state = flow.FLOW_CLIENT_DATA
+                if half.data:
+                    half.save['_appid_buf'] += half.data
+                    print sys.stderr, 'appid about to process'
+                    app = half.save['_appid'].process(f.p, f.sport, f.dport, half.data)
+                    print sys.stderr, 'appid returned %s' % (app,)
+                    if app[0] != -1: # APPID_CONTINUE
+                        break
+            if app[0] != -1:
+                event = appid.app_to_name(app[0]).lower()
+                print 'appid match:', event
+                if event in self.callbacks:
+                    f.save['_service'] = event
+                    for half in f.half.itervalues():
+                        half.data = half.save.pop('_appid_buf')
+                        del half.save['_appid']
+                    f.state = flow.FLOW_START
                     self.publish(event, f)
-                if f.server.data:
-                    f.state = flow.FLOW_SERVER_DATA
-                    self.publish(event, f)
-            else:
-                for half in f.half.itervalues():
-                    del half.save['_appid_buf']
-                    del half.save['_appid']
-                f.unregister(self.recv_flow)
+                    if f.client.data:
+                        f.state = flow.FLOW_CLIENT_DATA
+                        self.publish(event, f)
+                    if f.server.data:
+                        f.state = flow.FLOW_SERVER_DATA
+                        self.publish(event, f)
+                else:
+                    for half in f.half.itervalues():
+                        del half.save['_appid_buf']
+                        del half.save['_appid']
+                    f.unregister(self.recv_flow)
 
-    def __event_to_fcaps(self, event):
-        if event in _services:
-            return [ _services[event] ]
-        svcs = net.serv_aton(event)
-        l = []
-        for p in (1, 6, 17):
-            ports = [ str(svc[1]) for svc in svcs if svc[0] == p ]
-            if ports:
-                l.append('%s and dst port %s' %
-                         (net.proto_ntoa(p), ' or '.join(ports)))
-        return l
+        def __event_to_fcaps(self, event):
+            if event in _services:
+                return [ _services[event] ]
+            svcs = net.serv_aton(event)
+            l = []
+            for p in (1, 6, 17):
+                ports = [ str(svc[1]) for svc in svcs if svc[0] == p ]
+                if ports:
+                    l.append('%s and dst port %s' %
+                             (net.proto_ntoa(p), ' or '.join(ports)))
+            return l
 
-    def __proxy_register(self, event, callback):
-        # XXX - just proxy to FlowHandler
-        fcaps = self.__event_to_fcaps(event)
-        for fcap in fcaps:
-            self.subscribe('flow', fcap, callback)
+        def __proxy_register(self, event, callback):
+            # XXX - just proxy to FlowHandler
+            fcaps = self.__event_to_fcaps(event)
+            for fcap in fcaps:
+                self.subscribe('flow', fcap, callback)
 
-    def __proxy_unregister(self, event, callback):
-        # XXX - just proxy to FlowHandler
-        fcaps = self.__event_to_fcaps(event)
-        for fcap in fcaps:
-            self.unsubscribe('flow', fcap, callback)
+        def __proxy_unregister(self, event, callback):
+            # XXX - just proxy to FlowHandler
+            fcaps = self.__event_to_fcaps(event)
+            for fcap in fcaps:
+                self.unsubscribe('flow', fcap, callback)
+except ImportError, e:
+    pass