Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Copying TVBs for Reassembly [Was: Filebacked-tvbuffs : GSoC'

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 18 Apr 2013 17:30:53 -0400
On 04/18/13 17:13, Evan Huus wrote:
On Thu, Apr 18, 2013 at 4:53 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
Hmmm, the way you mentioned wiretap makes me think/realize that the TVBs
should not actually store the real offset (since we'd want that stuff
abstracted away by wiretap so the tvbuff code wouldn't have to deal with
ugliness like compressed files and so forth).  That might make it a bit
harder...  Unless we backed the TVBs with temporary files (seems wasteful
and a pain to clean up after).

Not sure I follow this, as I'm not sure what you mean by 'real
offset'. TVBs don't currently store any offset into the file itself.
And the virtual ones I described wouldn't have to, that information is
already in frame_data->file_off.

My original (not fully thought through) thought was probably something like: file-backed TVBs would basically have a new type (TVBUFF_FILEBACKED or something) and contain: - a pointer which can hold (malloc'd) memory for the contents of the TVB (for caching)
 - a file pointer (probably a bad idea)
 - a file offset

If instead the TVB points to the frame_data which has the offset (I didn't realize it did) then there's no need for the tvbuff to have it too.