>Message: 1
>Date: Mon, 18 Sep 2017 22:25:09 +0200
>From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
>To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
>Subject: Re: [Wireshark-dev] causes for losing COL_PROTOCOL or
> COL_INFO data
>Message-ID: <88D2443F-E363-4811-A5DC-C2BB18F2C11C@xxxxxxxxx>
>Content-Type: text/plain; charset=utf-8
>
>Hi John,
>
>Rule of thumb: don’t use ‘if (tree)...’ constructs.
>They have little if any use, don’t really save processing time (all wireshark functions are capable of handling tree==NULL), and >cause more trouble than it’s worth (as you’re in right now).
>
>Some of the finer details are that Wireshark runs the dissection engine, and therefore your dissector, several times for various >purposes, once sequentially, then at random.
>This is either with or without the tree parameter set. Dissectors must function so that they dissect the buffer the same either with >or without tree parameter.
>Data may be preserved of several stages, and that is why dissection needs to be done in all situations.
>
>Hope it helps reworking your code.
Yep, I've gotten the issue worked out. Thanks again to everyone for the help.
>Jaap
Best regards,
John D.
