Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 39149: /trunk/epan/dissectors/ /trunk/epan/dissectors/:

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Bill Meier wrote:
> On 9/27/2011 3:56 PM, Jeff Morriss wrote:
> > Actually a quick test indicates that we only build the column info on
> > the 2nd pass (for those frames which are currently displayed).
> >
> > In other words, if you've got 10,000 frames of which 25 are displayed in
> > your Wireshark window, your dissector is called 10,000 times with
> > check_col(COL_INFO)==0 and 25 times with check_col(COL_INFO)==1. As you
> > scroll down the dissector is called again for the newly-visible frames
> > with check_col(COL_INFO)==1. (It does appear that Wireshark does cache
> > the column information; scrolling back or clicking on earlier packets
> > does not result in the column info being rebuilt, even if the dissector
> > is called again.)
>
> Do I interpret the above to mean that the col_... fcns no longer need to 
> be guaranteed to be called on the "first pass" ?

Huh, the implication is "yes."  Though for some reason I'm not 
comfortable saying so.  (It's probably because I don't understand the 
inner workings of the GUI and whether this behavior might later change.)