Comment # 7
on bug 9949
from Guy Harris
(In reply to comment #4)
> 2. When running tshark the columns shouldn't be se-allocated anyways; I
> assume it's necessary for Wireshark (since the columns are displayed
> continually) but for tshark all the column data is free-able as soon as that
> packet has been printed.
Translating an address to a name can be time-consuming (looking up in a file;
worse, doing a DNS or NIS lookup; even worse, attempting such a lookup from an
unresponsive server), so caching the results of such a lookup is probably a
good idea.
Translating an address to a string can be somewhat time-consuming, but it's not
as bad; if you have to fill in every column when reading in a capture file, it
could take a significant amount of time. I seem to remember that it did so back
when we were using a widget for the packet list that required us to fill in all
columns at the time a row was first added to the list, and that's why we cached
the result of that translation if we couldn't map the address to a name or had
disabled address-to-name mapping.
However, the current widget doesn't require that, at least for GTK+ (if it does
for Qt, we should fix that), so caching address-to-string mappings might no
longer speed up the initial processing of a file in Wireshark. If it doesn't,
we should probably not bother caching them.
You are receiving this mail because:
- You are watching all bug changes.
