Wireshark-bugs: [Wireshark-bugs] [Bug 2205] New dissector plugin for Hilscher analyzer frames
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2205
--- Comment #5 from Stephen Fisher <stephentfisher@xxxxxxxxx> 2008-02-25 21:27:29 GMT ---
(In reply to comment #4)
> This dissector would be our first heuristic Ethernet dissector (that I found
> anyway). Adding it seems to slow down the loading of large (non-Hilscher)
> captures by 2-4% for me because the Ethernet dissector always tries heuristic
> dissectors first:
2-4%? Ouch!
> /*
> * In case the packet is a non-Ethernet packet inside
> * Ethernet framing, allow heuristic dissectors to take
> * a first look before we assume that it's actually an
> * Ethernet packet.
> */
> if (dissector_try_heuristic(heur_subdissector_list, tvb, pinfo, parent_tree))
>
>
> Are we OK with that? (It's not this dissector's fault: its heuristics should
> be pretty efficient, but still calling them 100k times to load a capture file
> takes a fair amount of time.)
Perhaps we need to add an eth.src heuristic table for this dissector to use, so
it is only passed the source MAC addresses to speed things up (hopefully).
> Or should the Ethernet dissector also get a "Try heuristic dissectors first?"
> preference (defaulted to FALSE)?
I would hate to do this because it reduces the default functionality of
Wireshark, but if it is that much slower we should probably do it.
--
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
