ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Reducing memory usage by saving fewer time stamps in frame_data

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 May 2012 20:00:34 -0700
On May 10, 2012, at 1:24 AM, Anders Broman wrote:

> Reduce Memory usage:
> - In frame_data.h it should be possible to cut down on the nstime_t structures by only having abs_ts and the others could be offsets to that or something similar thus saving a couple of bytes per packet.

"Time since first packet" is straightforward to calculate if, for example, the time stamp of the first packet is stored in the capture_file structure for the file.

"Time since previous captured packet" is straightforward to calculate given the current packet's frame_data structure and the previous packet's frame_data structure (which is straightforward to find if you know the current packet's frame number - if the frame number is 1 "time since previous captured packet" is your choice of 0 or "leave it blank because it's inapplicable" and if it's > 1 then it's the value for frame N-1).

"Time since previous displayed packet" is a bit more work - you have to scan backwards through frames until you either hit one with flags.passed_dfilter set or run out of frames (in which case the answer is either 0 or "leave it blank because it's inapplicable").