Wireshark-dev: Re: [Wireshark-dev] multiple parsing of the same packets
From: Anders Broman <[email protected]>
Date: Wed, 30 Oct 2013 14:25:27 +0000
>-----Original Message-----
>From: [email protected] [mailto:[email protected]] On Behalf Of Matthieu Patou
>Sent: den 30 oktober 2013 09:15
>To: Developer support list for Wireshark
>Subject: [Wireshark-dev] multiple parsing of the same packets
>I noticed long time ago that wireshark is parsing the same packet at least 3 tree times.
>To make it worse if I go back and forth to the same packet it will be dissected one more time.

A packet will be redissected when selected in the packet list

>With complex protocols like DRS (directory replication for Active
>directory) it's really a problem as the UI freeze for a while.
>First thing, why 3 dissections initially, is there a way to reduce this to 2, I more or less understand why 2 pass are needed but 3 ...

Is it 3 times for all packets or "only" for the ones visible in the GUI?

>Also is it possible to remember the dissection of packet so that we don't do it again and again ?

Generally probably not as that would require to keep the result of the dissection of all packets in memory. Dissectors can save data in
Per_packet_data or converssations and only do stuff if(!pinfo-visited) to do some stuff only once.

>Ps: I'm not on the list, so can you put me in copy of responses


Matthieu Patou
Samba Team

Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:[email protected]?subject=unsubscribe