Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] pinfo->fd->flags.visited and NFS

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 13 Jan 2010 23:40:56 -0800
On Jan 13, 2010, at 10:37 PM, Ian Schorr wrote:

> I'm still not clear on why your example is a problem though - what's
> the logic error in doing this test during an "if (tree)" block?

Does the test affect either

	1) the dissection of the current frame (e.g., what subdissectors are called);

	2) the dissection of any future frames (e.g., does it update any state information);

	3) any statistics/tap information?

If so, then doing it inside "if (tree)" is wrong because there's no guarantee that it will be called on any particular dissection of the packet other than

	1) dissections done to generate a protocol tree for display;

	2) dissections done to generate a protocol tree for a packet filter.