Hello Guys,
We have planned to plug a new dissector to already available family of dissectors in Wireshark (Linux).
A very brief idea is that Libpcap will be capturing packets (around 160-180 bytes) every 20 mili-sec from interfaces and will be providing the same to dissector.
There will be some significant number of interfaces available for such operation.
Can anyone please let me know if it is a possibility that dissection of packets may take significant time (considering complex nature of protocol) and capturing takes a backseat and some packet may get dropped? Is there a possibility that capturing is always on (at the highest priority) and whenever time is available dissection and display activities may be carried out?
Please provide your valuable feedback.
Regards,
Gaurav