Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 39149: /trunk/epan/dissectors/ /trun

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 28 Sep 2011 16:34:06 -0400
Bill Meier wrote:
On 9/27/2011 3:56 PM, Jeff Morriss wrote:

Actually a quick test indicates that we only build the column info on
the 2nd pass (for those frames which are currently displayed).

In other words, if you've got 10,000 frames of which 25 are displayed in
your Wireshark window, your dissector is called 10,000 times with
check_col(COL_INFO)==0 and 25 times with check_col(COL_INFO)==1. As you
scroll down the dissector is called again for the newly-visible frames
with check_col(COL_INFO)==1. (It does appear that Wireshark does cache
the column information; scrolling back or clicking on earlier packets
does not result in the column info being rebuilt, even if the dissector
is called again.)


Do I interpret the above to mean that the col_... fcns no longer need to be guaranteed to be called on the "first pass" ?

Huh, the implication is "yes." Though for some reason I'm not comfortable saying so. (It's probably because I don't understand the inner workings of the GUI and whether this behavior might later change.)