Wireshark-bugs: [Wireshark-bugs] [Bug 8069] Dissection of IPP Response PDU takes extremely long
Guy Harris
changed
bug 8069
| What |
Removed |
Added |
| Status |
UNCONFIRMED
|
RESOLVED
|
| Resolution |
---
|
DUPLICATE
|
Comment # 1
on bug 8069
from Guy Harris
(In reply to comment #0)
> When capturing IPP traffic, Wireshark can hang for an extremely long time
> when dissecting certain IPP response PDUs. The PDU is not overly large --
> around 5000 bytes.
There's more than one PDU there. There's the TCP PDU - i.e., the TCP segment,
which is the Protocol Data Unit for the Transmission Control Protocol - which
is about 1300 bytes. Then there's the IPP PDU - i.e., the IPP response, which
is the Protocol Data Unit for the Internet Printing Protocol - which is over
500,000 bytes. No, not 5000 bytes, 500,000 bytes.
> But when clicking the IPP Response reassembled PDU in the
> GUI, the interface shows a dialog that says "Processing: Packet Details" and
> then hangs. CPU usage is 100%. During this hang, the "Time Left" and
> progress bar do not update. After a good 10-15 minutes, it finally returns
> and shows the packet details.
It's constructing the tree for the protocol details *and* the "model" and
"view" for the GUI tree widget to display that tree. This takes a while.
In the current development version, we have a custom "model" that just uses the
existing protocol tree; admittedly, I'm running on a rather fast quad-core
machine with a ton of memory, but frame 551 displays rather quickly with a
Wireshark built from a freshly-updated trunk source tree.
> The PDU in question is quite bizarre, possibly due to something wrong with
> CUPS. I imagine it is confusing the dissector somehow.
It's making the dissector construct a complicated tree, but that's not the
problem here - the dissector appears to be working correctly.
*** This bug has been marked as a duplicate of bug 7224 ***
You are receiving this mail because:
- You are watching all bug changes.
