Wireshark · Ethereal-dev: [Ethereal-dev] Re: Improving filter speed

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

On Mon, 28 Mar 2005 16:09:23 +0000, didier <dgautheron@xxxxxxxx> wrote:
> ronnie sahlberg wrote:
> > Attached is a test patch, please test it.
> > 
> > Didier, this is a refactored version of your patch, it differs from
> > your original patch in that it
> > 1, does refcounting on whether fields and parent protocols are used or
> > not. (not neccessary here but might be useful in the future)
> yes but you lose :
> If the only field referenced is the protocol name then return NULL for
> tree.
> This one help a lot with color filters where a lot of rules are only 
> protocol name, at least here.

Ok, That can easily be added in the future.

> 
> > 2, renames the new variable and the function.
> > 3, it will use the refcounting information inside
> > proto_tree_add_item() and friends and avoid doing unneccessary work
> > for the fields that are not used.
> > (just checking per protocol is not optimal since some protocols   SMB
> > and H225 etc have many thousand filter fields each)
> You can't use
> TRY_TO_FAKE_THIS_ITEM(tree, hfindex);
> with all protocols.
> If you have an IPX catpure it will dump a core because it uses functions 
> like proto_item_get_len(), with TRY...  PITEM_FINFO(pi) is NULL.

I have changed the patch to only fake the item iff PITEM_FINFO(pi) is not NULL.

I dont think that this was absolutely neccessary since the only thing
that has this as NULL would be the top tree  and the only thing
attached to the top tree are nodes of type FT_PROTOCOL which the
previous patch checked for anyway.

Please test it.
Please send me any capture files where this patch makes ethereal crash.


> 
> Didier
> 
>

Attachment: filter_performance.diff.gz
Description: GNU Zip compressed data