ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Copying TVBs for Reassembly [Was: Filebacked-tvbuffs : GSoC'13]

From: Evan Huus <eapache@xxxxxxxxx>
Date: Thu, 18 Apr 2013 15:14:11 -0400
This is a tangential issue that has always confused me.

Why do we malloc+memcpy data for reassembly when we already have
'virtual' composite TVBs?

Wouldn't it be more efficient (in time and memory) to create a
composite TVB for each reassembly and then build the reassembled
packet in it? You would never have to copy or allocate any actual
packet data...

Or am I misunderstanding how composite TVBs actually work?

Thanks,
Evan

P.S. Clearly some protocols where the payload is XORed or hashed
wouldn't be able to do this, but most protocols doing reassembly just
carry the raw payload bytes.