Wireshark-dev: Re: [Wireshark-dev] Subdissectors for HTTP connect traffic
From: Guy Harris <[email protected]>
Date: Thu, 10 Aug 2006 16:56:08 -0700
On Aug 10, 2006, at 1:52 PM, Stephen Fisher wrote:

I see what you're saying.  The only information I'm keeping for the
duration of the conversation
For the duration of the conversation?

I.e., once you see the last packet of the conversation, it's not needed in order to correctly re-dissect any of the packets in the conversation?
(BTW, keeping a small data structure around as long as a capture file  
is open, if that's necessary in order to correctly re-dissect a  
packet, is OK - remember, once the first pass over the packets in a  
capture is complete, any packet in the capture can be accessed in any  
order at any time, so, once the first pass is done, there is *no*  
guarantee that, if packet N of the capture is being dissected, packet  
N-1 of the capture was the packet dissected immediately before that.)