Wireshark · Ethereal-dev: Re: [Ethereal-dev] dissector being called with same packets twice?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Friday, August 1, 2003, at 3:30 PM, Ronnie Sahlberg wrote:

> Ethereal will sometimes call the dissector twice for a packet when 
> reading a
> capture file.
> When it does so depends on whether you have any filters allied.
>
> First time it is called  tree will be NULL, second time TREE will hae a
> proper value.

If you have a read filter, there will be a first call in which tree 
will be non-null (the one in "read_packet()"), as you need a protocol 
tree to evaluate the read filter.  There will also be a second call, 
where tree will be non-null if color filters or tap listeners are 
active, null otherwise.  If you don't have a read filter, only the 
latter call will be done.

> the dissector must be prepared to handle that the dissector being 
> called
> mulktiple times for the
> same packet.

And even if the dissector is called only once when reading the capture 
file, it can be called again if the user clicks on the packet, or does 
display filtering, or does "Find Frame", or changes the color filters, 
or does a print operation - and, of course, there's no guarantee that 
packets won't then be dissected in some random order, rather than in 
sequential order.