Wireshark-dev: [Wireshark-dev] Idea for faster dissection on second pas
From: Anders Broman <[email protected]>
Date: Thu, 10 Oct 2013 22:22:15 +0200
If we in the UDP/TCP/(SCTP?) dissectors saved next dissector on the first pas in say per packet data we could avoid repeated calls to heuristic dissectors and port/conversation lookups making the second pas faster.
Does any one see any pitfalls with this idea?

I can think of two ways of implementing it:
- A new entry in pinfo "previous protocol" or something like that.
- make dissector_try_uint(), dissector_try_heuristic(), try_conversation_dissector() return the protocol
or NULL;

The second is perhaps cleaner but requires more changes or we could make new functions
dissector_try_heuristic_ret_proto() etc or something like that.