Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Problems dissecting large amounts of data

From: Brian Vandenberg <phantal@xxxxxxxxx>
Date: Tue, 26 Sep 2006 19:30:31 -0600
So, in other words, if I disable the hex pane everything will work smoothly -- I'll just have to handle displaying relevant data in the tree view? The very large payloads I wouldn't need to display in their entirety ... i could probably just show a few hex bytes, an md5 hash of the data in that payload, and that's about it.

-Brian

Guy Harris wrote:

On Sep 26, 2006, at 11:42 AM, Brian Vandenberg wrote:

  The window that I mentioned, showing progress of processed packet
data, that window appears twice.  Is this a redundancy that could be
eliminated?

In some cases, probably.  See below.


:- First, clicking the initial packet caused the 'Processing packet
data' window to appear twice.
:- Opening my dissector's tree caused the same thing to happen
:- Clicking line items in my tree, or opening subtrees would cause the
'processing' window to appear twice, then a very long delay I normally
don't wait for (waited 10 min once before giving up).

Whenever you select an item in the packet detail pane, the text widget with the hex/ASCII dump has to highlight the data corresponding to it. Unfortunately, that's currently done by *reconstructing the entire dump pane*, which is *another* thing that would probably be done better by a "virtual" widget of the type I describe - such a widget would highlight text when it draws it, so the time to redraw would be proportional to the amount of text *displayed*, not the total amount of text in the widget.

There are probably also extra calls to construct the dump pane being made.