Wireshark-dev: [Wireshark-dev] Expert Info Performance
I really like the Expert Info functionality and use it more and more.
Today I had to analyze a large capture (~200 MB) and here the dialog
gets to a limit.
Looking at the behavior, it almost looks like it is implemented as a
tap. Is it really needed to parse the whole capture again, just to have
the data structures filled? If it is a tap, could be always on? I don't
think that much memory would be 'lost'. I would pay that price. Am I
asking for too much?
Since this is core code, I'm not sure whether a dissector coder like me
is up to the task :-)
David