Wireshark · Wireshark-dev: Re: [Wireshark-dev] Memory consumption in tshark

[Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>]

On Tue, Aug 27, 2013 at 05:09:19PM -0400, Evan Huus wrote:
> We already do reassembly and a lot of other stateful work in single-pass
> mode. The only thing two-pass mode provides is the ability to "see the
> future" (for example, saying: this request has a response 5 packets later).

We need two pass also for correct out of order reassembly.