Wireshark · Ethereal-dev: Re: [Ethereal-dev] Tap extensions. Comments please.

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Sep 10, 2002 at 07:09:51AM +1000, Ronnie Sahlberg wrote:
> but epan_dissect_prime_dfilter() has to be called before epan_dissect_run()

Yes, it does - it sets up the protocol tree such that the code to
generate it knows which fields are of interest to filters.

But that still works with my suggestion.

> Can one take both epan_dissect_new() and epan_dissect_run() and move them
> outside the loops and then just leave epan_dissect_prime_dfilter() and
> dfilter_apply_edt() inside the loop?

No, but one can take epan_dissect_new() and epan_dissect_run() and move
them outside the loops, and just leave "epan_dissect_prime_dfilter()"
inside one loop and "dfilter_apply_edt()" inside another loop.

> Something like:
> epan_dissect_new()
> epan_dissect_run()
> loop over all entries:
>     epan_dissect_prime_dfilter()
>     dfilter_apply_edt()
> end-loop

No, something like

	epan_dissect_new()
	loop over all entries:
		epan_dissect_prime_dfilter()
	epan_dissect_run()
	loop over all entries:
		dfilter_apply_edt()

Two loops, but such is life.

> I assume it is epan_dissect_run() that is the expensive operation that
> actually dissects the entire packet.

Yes.