Wireshark · Wireshark-dev: [Wireshark-dev] RFC: Any reason not to do this?

[Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>]

In a profile, I was surprised to see that > 2.5% of time was spent calling dissect_sip_tcp_heur().  There are no SIP PDUs in the log.  HTTP was very similar.

Does the attached change look reasonable?  It does a quick check for the first character being printable before trying to extract the first line and check it for NULL characters.

Thanks,

Martin

Attachment: packet-sip.c.diff
Description: Binary data