ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Idea for faster dissection on second pas

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 11 Oct 2013 09:22:47 -0400
On 10/10/13 18:22, Evan Huus wrote:
It might be simpler and almost as efficient to have
recently-successful heuristic dissectors bubble nearer to the top of
the list so they are tried sooner. Port/conversation lookups are
hash-tables for the most part and likely won't be made noticeably
faster by caching.

Wouldn't that expose us to the risk that the dissection actually changes on the 2nd pass (because the call order of the heuristics changes)? That would look pretty weird...