Wireshark · Ethereal-dev: Re: [Ethereal-dev] Performance. Ethereal is slow when usinglargecaptures.

["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

----- Original Message ----- 
From: "Biot Olivier"
Sent: Sunday, November 16, 2003 12:50 PM
Subject: RE: [Ethereal-dev] Performance. Ethereal is slow when
usinglargecaptures.


> A second performance increase proposal I had in mind is to use hash lookup
> instead of sequential lookup for large value_string tables. Part of this
can
> be done with #define's (where either the existing linear lookup or the the
> yet-to-define hash lookup can be chosen), and the remaining part can be
> produced with scripts (similar to makeregdotc). But if we're eliminating
the
> number of (re)dissection passes this may not be relevant anymore...

Excellent suggestion.
Both SMB and DCE have value strings for the response code that are huge.
Both of these protocols are very common.
But there are also a lot of (the majority) value_strings that only contain a
small number of entries.

We could do something like

create :
struct val_string {
   int num_items;    /*initially set to 0 */
   bin_tree *tree;  /* binary tree holding  value and string values */
   value_string      /* the original value string tree */
}

Then we could create alternate functions to access the val_string that are
functionally equivalent to the ones accessing value_string.
Lots of work but will probably be worth it.

Each time val_to_string() is called we also do :
   if(val_string->num_items==0){   /* we have not converted this one yet */
     val_string->num_items=count_num_items_in(val_string->value_string);
     if(val_string->num_items>8){   /* only create the tree if it holds >8
(arbitrary value) items, if less items its probably not worth it */

val_string->tree=create_a_binary_tree_of_all_value_string_values(val_string-
>value_string);  /* make sure the tree is perfectly balanced */
     }
  }
  if(val_string->tree){  /* do we have a quick access tree or not ? */
    look_it_up_in_the_tree();
  } else {
    do_the_normal_lookup_walking_value_string_sequentially();
  }


We do our own binary tree handler.   We dont have to worry about
inserting/removing values or deleting the tree since it will never change.
We only implement an optimized function to build a tree given a value_string
and to look up a value in the tree.


Then we just convert all the value_string declarations one by one into
val_string declarations.