On Aug 10, 2006, at 1:52 PM, Stephen Fisher wrote:
I see what you're saying. The only information I'm keeping for the
duration of the conversation
For the duration of the conversation?
I.e., once you see the last packet of the conversation, it's not
needed in order to correctly re-dissect any of the packets in the
conversation?
(BTW, keeping a small data structure around as long as a capture file
is open, if that's necessary in order to correctly re-dissect a
packet, is OK - remember, once the first pass over the packets in a
capture is complete, any packet in the capture can be accessed in any
order at any time, so, once the first pass is done, there is *no*
guarantee that, if packet N of the capture is being dissected, packet
N-1 of the capture was the packet dissected immediately before that.)
