Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Setting to disable all expert info

From: "Sultan, Hassan" <sultah@xxxxxxxxxx>
Date: Wed, 2 Aug 2017 21:23:50 +0000
Thanks for the link Pascal, I wasn't aware of it. I'll look up how tshark does and try to replicate that.

> -----Original Message-----
> From: Pascal Quantin [mailto:pascal.quantin@xxxxxxxxx]
> Sent: Wednesday, August 02, 2017 1:05 PM
> To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
> Cc: Sultan, Hassan <sultah@xxxxxxxxxx>
> Subject: Re: [Wireshark-dev] Setting to disable all expert info
> 
> 
> 
> 2017-08-02 22:00 GMT+02:00 Sultan, Hassan via Wireshark-dev <wireshark-
> dev@xxxxxxxxxxxxx <mailto:wireshark-dev@xxxxxxxxxxxxx> >:
> 
> 
> 	Here's my scenario :
> 
> 	I am planning on using the Wireshark parsing engine in two ways :
> 	1) process massively large captures
> 	2) process live traffic, hopefully in the long term in a permanent manner
> once the memory growth of the engine can be controlled
> 
> 
> 
> Did you have a look at https://blog.wireshark.org/2014/07/to-infinity-and-
> beyond-capturing-forever-with-tshark/ ?
> 
> 
> 
> 	In both cases, my automation does not care about any experts at all, it
> only needs the field information (length/offset/name/hierarchy/encoding...) so
> these experts are consuming memory for nothing in our case.
> 
> 	As Wireshark evolves, new dissectors get added, which might add new
> experts, and not having a global setting to turn them off would force us to
> repeatedly search for new experts appearing, which is not a great experience.
> 
> 	Now granted, I haven't done measurements on how much memory they
> consume, the current experts might not represent much, but it's hard to judge
> when experts can appear in any new dissector, one could appear tomorrow that
> significantly alters that.
> 
> 
> 
> Indeed they probably do not represent much compared to all the fields
> registered by dissectors. Moreover you are the first one I remember asking for
> such a feature. Like Jaap, I do not think this is a good move as of today.
> 
> 
> 
> 
> 	Thanks,
> 
> 	Hassan
> 
> 
> 	> -----Original Message-----
> 	> From: Wireshark-dev [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx
> <mailto:wireshark-dev-bounces@xxxxxxxxxxxxx> ] On Behalf
> 	> Of Jaap Keuter
> 	> Sent: Wednesday, August 02, 2017 11:59 AM
> 	> To: Sultan, Hassan via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx
> <mailto:wireshark-dev@xxxxxxxxxxxxx> >
> 	> Subject: Re: [Wireshark-dev] Setting to disable all expert info
> 	>
> 	> Are we going to be picking off features one by one to get the memory
> footprint
> 	> down? Then I see a long list of preference settings growing from this.
> Not
> 	> something I look forward to.
> 	>
> 	>
> 	> On 02-08-17 20:43, Sultan, Hassan via Wireshark-dev wrote:
> 	> > Hi,
> 	> >
> 	> >
> 	> >
> 	> > Am I right in my understanding that there is no global way of
> 	> > disabling insertion of expert information ?
> 	> >
> 	> >
> 	> >
> 	> > Assuming I’m correct, would anyone object to me adding that
> setting ?
> 	> > That would be another way of lowering memory footprint.
> 	> >
> 	> >
> 	> >
> 	> > Thx,
> 	> >
> 	> >
> 	> >
> 	> > Hassan
> 	> >
> 	> >
> 	>
> _________________________________________________________________
> 	> __________
> 	> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx
> <mailto:wireshark-dev@xxxxxxxxxxxxx> >
> 	> Archives:    https://www.wireshark.org/lists/wireshark-dev
> <https://www.wireshark.org/lists/wireshark-dev>
> 	> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-
> dev <https://www.wireshark.org/mailman/options/wireshark-dev>
> 	>              mailto:wireshark-dev-request@xxxxxxxxxxxxx
> <mailto:wireshark-dev-request@xxxxxxxxxxxxx> ?subject=unsubscribe
> 	__________________________________________________________
> _________________
> 	Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx
> <mailto:wireshark-dev@xxxxxxxxxxxxx> >
> 	Archives:    https://www.wireshark.org/lists/wireshark-dev
> <https://www.wireshark.org/lists/wireshark-dev>
> 	Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-
> dev <https://www.wireshark.org/mailman/options/wireshark-dev>
> 	             mailto:wireshark-dev-request@xxxxxxxxxxxxx <mailto:wireshark-
> dev-request@xxxxxxxxxxxxx> ?subject=unsubscribe
>