Wireshark · Ethereal-dev: Re: [Ethereal-dev] Improving filter speed

[Gilbert Ramirez <gilbertr@xxxxxxxxx>]

What kind of speed improvements are you seeing? Timing it with
tethereal will probably be easier than with ethereal.

--gilbert


On Wed, 16 Mar 2005 21:52:40 +0000, didier <dgautheron@xxxxxxxx> wrote:
> Hi
> Filters are slow because dissectors are called with a non null tree
> parameter.
> If you assume that:
> 1) in a frame with A- B -C -D protocols and a filter C.x you can only
> fully decode  C
> 2) if a filter field is only a protocol type  ie tcp, afp you don't need to
> you can speed it a lot
> 
> Attached patch:
> proto.c proto.h the logic.
> 
> packet-xxx.c dissectors using it.
> Comments?
> 
> regards
> Didier
> 
>