Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] TCP dissect issue when app-level message spans multiple TC

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 5 May 2011 14:34:16 -0700
On May 5, 2011, at 1:49 PM, John Sullivan wrote:

> I think knowing these things is pretty useful for the prospective
> dissector writer - it certainly gives a better feel for the dynamics
> of dissection and may help optimize the places where expensive work is
> done - so I think that section of the documentation ought to be
> expanded to mention it.

Actually, what dissector writers need to know is "do not make any assumptions whatsoever about whether the tree argument will be null or not on any pass through the packets, as it's subject to change from release to release, from user configuration to user configuration, and from program to program (dissectors currently run in Wireshark *and* TShark)".