Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Performance plug-in problem

From: Guillaume PETIT <guillaume1360@xxxxxxxxx>
Date: Thu, 26 Aug 2010 21:58:08 +0200
Hello,

I developped a plug-in to decode a specific protocol. This protocol is made of 256 "words" of 256 bytes.
I have to decode those "words" grouping them in regard with the nature of thoses 4 bytes word.
A 7 bits fields present in the the "word" (4 bytes), allow me to define the nature of the "word".

To group my word, i defined an array: tab[256][256] in which I classed my word.
My plug-in is decoding properly my protocol on 1 frame.

Nevertheless, when I load a important capture of 50Mbytes, Wireshark crash. I don't understand why.
I imagine my problem is link to the wireshark perforance.

Could you help me to improve my code ?
Could you explained my how wireshark is working when it uses a plug-in ?

Regards.

Guillaume