Hello Guys,
We have planned to plug a new dissector to already available
family of dissectors in Wireshark (Linux).
A very brief idea is that Libpcap will be capturing packets
(around 160-180 bytes) every 20 mili-sec from interfaces and will be providing
the same to dissector.
There will be some significant number of interfaces available
for such operation.
Can anyone please let me know if it is a possibility that dissection
of packets may take significant time (considering complex nature of protocol) and
capturing takes a backseat and some packet may get dropped? Is there a possibility
that capturing is always on (at the highest priority) and whenever time is
available dissection and display activities may be carried out?
Please provide your valuable feedback.
Regards,
Gaurav