When running a capture or when opening a captured file, wireshark
dissects it to build the display tree and all. What I also observed is
that when I select a packet in the display it once again calls the
dissector to analyze the packet. This seems to be a little wasteful
since the analysis done earlier is discarded.
It also poses a problem for streaming protocols like RTMP where what
was seen earlier decides how to make sense of the current data. For
example, RTMP has header optimizations by which message length is sent
only once and subsequent RTMP chunks use the length sent earlier. Is
there a way to turn this off and always use the initial analysis?
Thanks,
Sudarshan
