Wireshark-dev: Re: [Wireshark-dev] multiple parsing of the same packets
From: Matthieu Patou <[email protected]>
Date: Wed, 30 Oct 2013 11:20:34 -0700
On 10/30/2013 07:31 AM, Evan Huus wrote:
On Wed, Oct 30, 2013 at 4:14 AM, Matthieu Patou <[email protected]> wrote:

I noticed long time ago that wireshark is parsing the same packet at least 3
tree times.

To make it worse if I go back and forth to the same packet it will be
dissected one more time.
With complex protocols like DRS (directory replication for Active directory)
it's really a problem as the UI freeze for a while.
Is the protocol really so complex that dissecting a single packet of
it takes a user-visible amount of time? That seems suspect to me.
So what I did is that I'm dissecting the deferred RPC pointers only if tree != NULL the dissection of pointers takes a while because there is ~ 1700 top level pointers and each of them have a lot inner pointers, DRS is a very complicated protocol.
First thing, why 3 dissections initially, is there a way to reduce this to
2, I more or less understand why 2 pass are needed but 3 ...
It is in theory possible, the third pass is usually either to fill in
the column or tree information. We could in theory pull that straight
from the second pass, but we would have to calculate in advance which
packets are visible, which may or may not be easy.
Pardon my wireshark ignorance but it really look like the 2nd and the 3rd pass are recreating the thing from scratch.
Also is it possible to remember the dissection of packet so that we don't do
it again and again ?
It is quite possible, it just takes an enormous amount of memory. I
actually hacked together a patch for this a few weeks ago while doing
some performance tests [1].

[1] http://www.mail-archive.com/[email protected]/msg29107.html
Well memory is not limitless neither ...

Matthieu Patou
Samba Team