ACK
For those of us that normally work with 500MB+ capture files, every single rescan/refilter of a capture is very painful.
I currently have issues with reassembled packet now frequently require
a full rescan of the file which i have examples of but not time
to track down why it happens.
On 10/21/05, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
Gilbert Ramirez wrote:
>applied, but with a comment added and the old cf_retap totally removed
>instead of commented out.
>
>SVN 16279
>
>--gilbert
>
>
>
>On 10/20/05, Greg Morris <
gmorris@xxxxxxxxxx> wrote:
>
>
>>Expert data must perform a re-dissection to trigger the NCP dissector.
>>
>>
If the NCP dissector doesn't work with the expert info and some other
dissectors do, it might be a problem with the dissector and *not* with
the expert mechanism ...
>>Change the call cf_retap_packets() to cf_redissect_packets().
>>
>>
Hmmm, the expert.c
uses the tapping mechanism to "send" the data.
expert_dlg uses this tap to get the data
There must be a real misconception somewhere. Why it is not enough to
call cf_retap_packets(), maybe using code parts under if(tree)?.
I really would like to get an explanation to this, all of the dissectors
where I've added expert info was working pretty well the way it was
implemented.
Regards, ULFL
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
