Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Calling dissector with proto_tree==NULL

From: Fabrizio Bertocci <fabrizio@xxxxxxx>
Date: Thu, 24 Jan 2008 14:14:54 -0800
All,
I am working on a newer version of the RTPS packet dissector (real- time publisher/subscriber). I have noticed that my packet dissector gets called every time with the proto_tree parameter not NULL, including when the packets are loaded in memory. Unfortunately there are some complex packets that require some heavy computation that should not be necessary unless the packet is selected. As result of this, loading a file (with those packets) takes quite a long time...

The documentation said that wireshark calls the packet dissector with proto_tree != NULL only when the entire tree is needed. Any idea why? Is it something that has changed over the time? Is it something I'm doing wrong?

I'm registering the protocol on top of UDP with a simple call to:
heur_dissector_add("udp", dissect_rtps, proto_rtps);

Thanks for any help provided!
Fabrizio