Ethereal-dev: Re: [Ethereal-dev] getting data from subdissectors

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 16 Dec 2001 11:47:28 -0800
On Sat, Dec 15, 2001 at 11:38:50PM -0500, Ed Warnicke wrote:
> Hmm... how expensive is generating a protocol tree...

Very.

I built a version of Ethereal (current CVS) that always builds the
protocol tree in "add_packet_to_packet_list()".  That version took about
46 user-mode CPU seconds to read to read the capture file in; the
standard version took about 24 user-mode CPU seconds.  The progress bar
moved significantly faster in the standard version.

> many dissectors 
> parse most of the packet data anyway to either build their column info 
> or to generate conversations or decide how to call subdissectors.

The capture file in question is largely SMB; the SMB dissector does all
of the above.

> Given that, how much more work is it to construct the protocol tree?

A lot, it appears.  Therefore, I'm not at all inclined to have Ethereal
always generate protocol trees; it's slow enough *already* at reading in
large capture files, I *really* don't want to make it worse.