Ethereal-dev: Re: [Ethereal-dev] dissector being called with same packets twice?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 1 Aug 2003 15:54:07 -0700

On Friday, August 1, 2003, at 3:30 PM, Ronnie Sahlberg wrote:
Ethereal will sometimes call the dissector twice for a packet when reading a 
capture file.
When it does so depends on whether you have any filters allied.

First time it is called  tree will be NULL, second time TREE will hae a
proper value.
If you have a read filter, there will be a first call in which tree will be non-null (the one in "read_packet()"), as you need a protocol tree to evaluate the read filter. There will also be a second call, where tree will be non-null if color filters or tap listeners are active, null otherwise. If you don't have a read filter, only the latter call will be done.
the dissector must be prepared to handle that the dissector being called 
mulktiple times for the
same packet.
And even if the dissector is called only once when reading the capture file, it can be called again if the user clicks on the packet, or does display filtering, or does "Find Frame", or changes the color filters, or does a print operation - and, of course, there's no guarantee that packets won't then be dissected in some random order, rather than in sequential order.