Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Idea for faster dissection on second pas

From: Anders Broman <a.broman@xxxxxxxxxxxx>
Date: Thu, 10 Oct 2013 22:22:15 +0200
Hi,
If we in the UDP/TCP/(SCTP?) dissectors saved next dissector on the first pas in say per packet data we could avoid repeated calls to heuristic dissectors and port/conversation lookups making the second pas faster.
Does any one see any pitfalls with this idea?

I can think of two ways of implementing it:
- A new entry in pinfo "previous protocol" or something like that.
or
- make dissector_try_uint(), dissector_try_heuristic(), try_conversation_dissector() return the protocol
or NULL;

The second is perhaps cleaner but requires more changes or we could make new functions
dissector_try_heuristic_ret_proto() etc or something like that.

Comments?

Regards
Anders