Le vendredi 11 octobre 2013 ￜ 09:22 -0400, Jeff Morriss a ￜcrit :
> On 10/10/13 18:22, Evan Huus wrote:
> > It might be simpler and almost as efficient to have
> > recently-successful heuristic dissectors bubble nearer to the top of
> > the list so they are tried sooner. Port/conversation lookups are
> > hash-tables for the most part and likely won't be made noticeably
> > faster by caching.
>
> Wouldn't that expose us to the risk that the dissection actually changes
> on the 2nd pass (because the call order of the heuristics changes)?
> That would look pretty weird...
Yes it would. My memories are fuzzy (I did this stuff more than 5 years
ago) but
1- you can sort heuristic dissectors by used/unused and keep the
relative order.
2 - after the first pass you can stop at the first unused dissector
3 - and/or saved in packet info a boolean for heuristic/non heuristic
dissector, it helps a lot for packets without leaf dissectors.
I think I also extended conversation semantic for not calling
heuristic_try in most cases.
Didier