Wireshark-dev: Re: [Wireshark-dev] causes for losing COL_PROTOCOL or COL_INFO data
From: John Dill <[email protected]>
Date: Tue, 19 Sep 2017 12:54:01 +0000
>Message: 1
>Date: Mon, 18 Sep 2017 22:25:09 +0200
>From: Jaap Keuter <[email protected]>
>To: Developer support list for Wireshark <[email protected]>
>Subject: Re: [Wireshark-dev] causes for losing COL_PROTOCOL or
>       COL_INFO data
>Message-ID: <[email protected]>
>Content-Type: text/plain; charset=utf-8
>
>Hi John,
>
>Rule of thumb: don’t use ‘if (tree)...’ constructs.
>They have little if any use, don’t really save processing time (all wireshark functions are capable of handling tree==NULL),  and >cause more trouble than it’s worth (as you’re in right now).
>
>Some of the finer details are that Wireshark runs the dissection engine, and therefore your dissector, several times for various >purposes, once sequentially, then at random.
>This is either with or without the tree parameter set. Dissectors must function so that they dissect the buffer the same either with >or without tree parameter.
>Data may be preserved of several stages, and that is why dissection needs to be done in all situations.
>
>Hope it helps reworking your code.

Yep, I've gotten the issue worked out.  Thanks again to everyone for the help.

>Jaap

Best regards,
John D.