Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: Improving filter speed

[didier <dgautheron@xxxxxxxx>]

ronnie sahlberg wrote:
> Attached is a test patch, please test it.
>
> Didier, this is a refactored version of your patch, it differs from
> your original patch in that it
> 1, does refcounting on whether fields and parent protocols are used or
> not. (not neccessary here but might be useful in the future)
yes but you lose :
If the only field referenced is the protocol name then return NULL for tree.
This one help a lot with color filters where a lot of rules are only 
protocol name, at least here.

> 2, renames the new variable and the function.
> 3, it will use the refcounting information inside
> proto_tree_add_item() and friends and avoid doing unneccessary work
> for the fields that are not used.
> (just checking per protocol is not optimal since some protocols   SMB
> and H225 etc have many thousand filter fields each)
You can't use
TRY_TO_FAKE_THIS_ITEM(tree, hfindex);
with all protocols.
If you have an IPX catpure it will dump a core because it uses functions 
like proto_item_get_len(), with TRY...  PITEM_FINFO(pi) is NULL.

Didier