Wireshark-dev: Re: [Wireshark-dev] multiple parsing of the same packets

From: Anders Broman <anders.broman@xxxxxxxxxxxx>
Date: Wed, 30 Oct 2013 14:25:27 +0000

>-----Original Message-----
>From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Matthieu Patou
>Sent: den 30 oktober 2013 09:15
>To: Developer support list for Wireshark
>Subject: [Wireshark-dev] multiple parsing of the same packets
>
>Hello,
>
>I noticed long time ago that wireshark is parsing the same packet at least 3 tree times.
>
>To make it worse if I go back and forth to the same packet it will be dissected one more time.

A packet will be redissected when selected in the packet list

>With complex protocols like DRS (directory replication for Active
>directory) it's really a problem as the UI freeze for a while.
>
>First thing, why 3 dissections initially, is there a way to reduce this to 2, I more or less understand why 2 pass are needed but 3 ...

Is it 3 times for all packets or "only" for the ones visible in the GUI?

>
>Also is it possible to remember the dissection of packet so that we don't do it again and again ?

Generally probably not as that would require to keep the result of the dissection of all packets in memory. Dissectors can save data in
Per_packet_data or converssations and only do stuff if(!pinfo-visited) to do some stuff only once.

>Ps: I'm not on the list, so can you put me in copy of responses

Matthieu.

--
Matthieu Patou
Samba Team
http://samba.org

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe