Feel free to reverse that change.
It was part of an effort to start refactoring the code so that it
would eventually become possible to multithread wireshark, but the
work required to implement everything required is just too massive to
be realistic.
On 3/5/07, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
Hi!
In an attempt to fix bug 1419 I've stumbled over a strange change that
Ronnie Sahlberg made in SVN 20251 and I'm asking if there's a reason for
it that I just don't see.
The comment to 20251:
"break out dfcode from the capture file structure and declare it locally
where it is needed. allocate and release the dfcode program as needed
instead of having it hang around in the capture file structure. this
will ensure that dfcode will not have longer than se scope lifetime in
case we need that property of it later"
The problem with this change: It's calling the line:
dfilter_compile(cf->dfilter, &dfcode);
each time cf_continue_tail() get's called, which takes place when new
packets are added to the packet list while CAPTURING
(this update takes place SEVERAL times a second for an "Update list in real
time" capture).
So we're computing the whole display filter (which might be very long) over
and over and over again while capturing,
to avoid some minor memory consumption / allocation problems?!?
That makes packet drops more likely without a good reason!!!
In addition, I don't see a good reason for this re-compiling at all!
The common sequence for an "Update list in real time" capture will look
like:
cf_start_tail
cf_continue_tail
cf_continue_tail
cf_continue_tail
...
cf_continue_tail
cf_finish_tail
So why not simply dfilter_compile() at cf_start_tail() and dfilter_free() at
cf_finish_tail() ?!?
Regards, ULFL
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev
