Wireshark-dev: Re: [Wireshark-dev] multiple parsing of the same packets
From: Matthieu Patou <[email protected]>
Date: Wed, 30 Oct 2013 16:40:18 -0700
On 10/30/2013 07:25 AM, Anders Broman wrote:
-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Matthieu Patou
Sent: den 30 oktober 2013 09:15
To: Developer support list for Wireshark
Subject: [Wireshark-dev] multiple parsing of the same packets


I noticed long time ago that wireshark is parsing the same packet at least 3 tree times.

To make it worse if I go back and forth to the same packet it will be dissected one more time.
A packet will be redissected when selected in the packet list

With complex protocols like DRS (directory replication for Active
directory) it's really a problem as the UI freeze for a while.

First thing, why 3 dissections initially, is there a way to reduce this to 2, I more or less understand why 2 pass are needed but 3 ...
Is it 3 times for all packets or "only" for the ones visible in the GUI?
I don't know when I start wireshark it has always an empty filter but I suspect that it's only for the visible ones.

Matthieu Patou
Samba Team