["Lars Ruoff" <lars.ruoff@xxxxxxxxxxxxxxxxxx>]

RTP Analysis: need help with redissect_packets implementation details

Hi list,
I still dont understand very well how packets are dissected.
In my modifications to RTP Analysis, i got rid of the filter expression.
But in order to redissect the packets, i still call redissect_packets, which
in turn calls
rescan_packets(... , TRUE, TRUE)
Would there be a significant performance increase if we rather called
rescan_packets(... , FALSE, FALSE) ??
Also, I notice that the protocol tree is still being built when there are
color filters defined.
(Regardless of the redissect parameter)

that's because of a condition in file.c:add_packet_to_packet_list :
  if ((cf->dfcode != NULL && refilter) || filter_list != NULL
        || num_tap_filters != 0)
   create_proto_tree = TRUE;

where filter_list!=NULL if color filters are defined.
But tap-dissection doesnt have to care about color filters, does it?
It seems to me that we should add another execution path in the case we have
only a tap running that wants to collect some information about the packets
it sees.

best regards,
Lars Ruoff