["Greg Morris" <GMORRIS@xxxxxxxxxx>]

Guy,

 

I hate to appear dumb but is the reason for this because after the trace has been opened and dissected then if you filter the trace then the lookup will not be processed on these packets because they already have the flag set? If so would it be better to leave the hash until the trace is closed? Please advise.

 

Greg

>>> Guy Harris <guy@xxxxxxxxxx> 2/25/2003 11:44:59 AM >>>

On Tue, Feb 25, 2003 at 08:38:36AM -0700, Greg Morris wrote:
> Potential error if hash lookup for NDS EID is null.
> 
> GLib-CRITICAL **: file ghash.c: line 138 (g_hash_table_lookup):
> assertion `hash_table != NULL' failed.
> 
> Added check prior to hash lookup for flags.visited.

Unfortunately, one result of that check is that one item will be added
to the protocol tree only on the first pass through the capture file and
on any subsequent pass that forces a redissection, as there's a
"proto_tree_add_string_format()" call inside

    if (!pinfo->fd->flags.visited) {

        ...

    }

You need to come up with a scheme to get the EID value even *after*
you've destroyed the hash table, e.g. by attaching it to the frame as
per-packet data.