Wireshark-dev: Re: [Wireshark-dev] Wireshark conference

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sat, 30 Jun 2007 12:22:51 +0200
Gerald Combs schrieb:
This is entirely hypothetical, but if someone were to host a 3-day
Wireshark conference, what sort of sessions would you be interested in?
If enough developers attended, would there be interest in a hackathon?
Funny! As I took part in a developer meeting of openstreetmap.org, I was thinking about something like this for quite a while already :-)


Would this event be more developer or more user centric (or both)?


For the developer side - talk about the bigger issues of the future:

a) multithreading: What's to be changed in WS code to get a real performance boost in todays and tomorrows multi-core CPU's (and how to get there in reality without breaking all the code) - this would also solve much of the problerms with multiple files in one Wireshark instance

b) application layer dissection: We have conversations, but IMHO still missing a generic way to help dissector coders write application layer centric things: - pass "conversation handles" between dissectors - so upper layer dissectors don't have to "rebuild" lower layer conversations - a generic way to export/copy application data (e.g. HTTP payload, POP Mails, ...) - display multiple payloads in one packet (e.g. multiple lines - or a subtree - in the packet list)
- ...
IMHO, the days of packet dissection development are more or less over - currently, most development is done at the application layer. Unfortunately, most of our "API code" is still biased towards packets, making the development of application level code much more complicated than it could be.

c) solve the "outofmemory" issue somehow ...

I could prepare a short speech and slides about some ideas I have about these things, which could be a base for further discussions.


For the user side - what's the most desperate feature you're still missing (I'll duck and cover now ...)?


It would be nice to see the "mailing list names" in real life ...

Regards, ULFL