ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Expert Infos are a bit "more official" now!

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Mon, 27 Aug 2007 23:12:35 +0200
Stratemeier, Frank schrieb:
Yo Chris!
I had the same problem and was just wondering why. It seems that "Expert Info" rescans a capture passing no valid tree pointer. "Expert Info Composite" does indeed pass a valid tree pointer!.
So in my dissector the EIC makes much more sense.
You should not depend on tree!=NULL, as the expert info is NOT ONLY a part of the packet tree - but an instance in itself! I've added an according note to the wiki page.

When I've implemented the "Expert Info" I've optimized it for performance. Unfortunately, the "Expert Info Composite" is not optimized - it should NOT pass tree != NULL, as this *significantly* slows down the scanning - so this might be changed in the future.

If you scan a 100MB+ trace, you will see the difference.
You said that the "old" EI will not be available in some future point of time?
If the composite gets the filtering function and is optimized for performance, the "old" expert info is obsolete and will be removed.

Having two almost identical dialogs is confusing and therefore not very user friendly ...

Regards, ULFL