Wireshark-dev: Re: [Wireshark-dev] Copying TVBs for Reassembly [Was: Filebacked-tvbuffs : GSoC'
From: Jeff Morriss <[email protected]>
Date: Thu, 18 Apr 2013 15:56:53 -0400
On 04/18/13 15:14, Evan Huus wrote:
This is a tangential issue that has always confused me.

Why do we malloc+memcpy data for reassembly when we already have
'virtual' composite TVBs?

Wouldn't it be more efficient (in time and memory) to create a
composite TVB for each reassembly and then build the reassembled
packet in it? You would never have to copy or allocate any actual
packet data...
There are a couple of problems with doing that (that I recall):

1) Composite TVBs don't actually work (or didn't work until very recently?).

2) The data behind a TVB goes away as soon as we're done dissecting (and displaying) the packet. That is, the TVB data is overwritten (IIRC) when the next packet is read.
I suppose there was never any real reason to try to make reassembly work 
with composite TVBs: if they're just more malloc()'d memory then why 
mess with it rather than allocate our own copy of the data?  (Well, OK, 
it would save a data copy, but...)