Wireshark-dev: Re: [Wireshark-dev] Subdissectors for HTTP connect traffic
From: Joerg Mayer <[email protected]>
Date: Thu, 10 Aug 2006 22:21:14 +0200
On Thu, Aug 10, 2006 at 11:46:29AM -0700, Stephen Fisher wrote:
> > in terms of CPU overhead? What will that mean in terms of long term 
> > memory usage?
> As for memory usage, the current http dissector allocates the stat_info 
> structure for every packet that it sees (ep_alloc) whereas my patch 
> changes this to one seasonal allocation for each conversation (se_alloc) 
> so the memory use is basically the same.

That's the point where I'm not sure: Look at an example where someone
transferrs a dvd-image over https. So far, we look at each packet and
once it's gone, the memory is freed. With conversations the memory will
be freed once the conversation is over - which might be a bit more
memory consuming. I don't have very detailed knowledge of conversation
stuff, but that's how it looks to me at first sight.
Don't get me wrong, I very much like the new feature, but if I'm
correct, there should be a button to enable/disable this feature.


Joerg Mayer                                           <[email protected]>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.