Ethereal-dev: Re: [Ethereal-dev] Tap extensions. Comments please.
----- Original Message -----
From: "Guy Harris"
Sent: Tuesday, September 10, 2002 7:32 AM
Subject: Re: [Ethereal-dev] Tap extensions. Comments please.
> On Tue, Sep 10, 2002 at 07:09:51AM +1000, Ronnie Sahlberg wrote:
> > but epan_dissect_prime_dfilter() has to be called before
epan_dissect_run()
>
> Yes, it does - it sets up the protocol tree such that the code to
> generate it knows which fields are of interest to filters.
Ok. it is just used so that the dissection we do later will know which
fileds
are of interest and which are not.
Can we here say that ALL fields are of interest? Would that impact
performance much?
If you tell me how to say "ALL fields are of interest I can test the
performance impact"
>
> But that still works with my suggestion.
>
> > Can one take both epan_dissect_new() and epan_dissect_run() and move
them
> > outside the loops and then just leave epan_dissect_prime_dfilter() and
> > dfilter_apply_edt() inside the loop?
>
> No, but one can take epan_dissect_new() and epan_dissect_run() and move
> them outside the loops, and just leave "epan_dissect_prime_dfilter()"
> inside one loop and "dfilter_apply_edt()" inside another loop.
>
> > Something like:
> > epan_dissect_new()
> > epan_dissect_run()
> > loop over all entries:
> > epan_dissect_prime_dfilter()
> > dfilter_apply_edt()
> > end-loop
>
> No, something like
>
> epan_dissect_new()
> loop over all entries:
> epan_dissect_prime_dfilter()
> epan_dissect_run()
> loop over all entries:
> dfilter_apply_edt()
But it is the epan_dissect_run() that is the expensive one? right? the one
which actually dissects the packet? It doesnt matter much if we have it in
the inner most loop or not
since in the normal case the inner loop in reality has an ifstatement that
mostly triggers
only once per loop.
>
> Two loops, but such is life.
>
> > I assume it is epan_dissect_run() that is the expensive operation that
> > actually dissects the entire packet.
>
> Yes.
So, perhaps if one could change epan_dissect_prime_dfilter() call to say
"Gimme all
fields, Im interested in them all" then one could move it, and more
important epan_dissect_run() to outside the loops?
so we would end up with:
epan_dissect_new()
epan_dfilter_prime_dfilter() [ALL fields are interesting]
epan_dissect_run()
loop over all entries:
dfilter_apply_edt()
end-loop
Would saying something like : ALL fields are interesting : degrade
perfrmance? Maybe but before actually measuring the impact I would guess
that the multiple calls to epan_dissect_run() would be even worse.
