[Anders Broman <a.broman58@xxxxxxxxx>]

Hi,

Should heuristic (udp/tcp) be default off to speed up dissection of larger files? Or

should we just disable the more unusual ones?

I'm Leaning towards default off and users would have to learn to enable relevant ones.

Or is that too much to ask from inexperienced users? On the other hand it can be hard to

know if a heuristic detection is a false positive.

Best regards

Anders