Wireshark-dev: [Wireshark-dev] Expert Info Performance

From: David Aggeler <david_aggeler@xxxxxxxxxx>
Date: Mon, 23 Feb 2009 23:40:21 +0100

I really like the Expert Info functionality and use it more and more. Today I had to analyze a large capture (~200 MB) and here the dialog gets to a limit.

Looking at the behavior, it almost looks like it is implemented as a tap. Is it really needed to parse the whole capture again, just to have the data structures filled? If it is a tap, could be always on? I don't think that much memory would be 'lost'. I would pay that price. Am I asking for too much?

Since this is core code, I'm not sure whether a dissector coder like me is up to the task :-)

David