Wireshark · Wireshark-dev: Re: [Wireshark-dev] Subdissectors for HTTP connect traffic

[Joerg Mayer <jmayer@xxxxxxxxx>]

On Thu, Aug 10, 2006 at 11:46:29AM -0700, Stephen Fisher wrote:
> > in terms of CPU overhead? What will that mean in terms of long term 
> > memory usage?
> 
> As for memory usage, the current http dissector allocates the stat_info 
> structure for every packet that it sees (ep_alloc) whereas my patch 
> changes this to one seasonal allocation for each conversation (se_alloc) 
> so the memory use is basically the same.

That's the point where I'm not sure: Look at an example where someone
transferrs a dvd-image over https. So far, we look at each packet and
once it's gone, the memory is freed. With conversations the memory will
be freed once the conversation is over - which might be a bit more
memory consuming. I don't have very detailed knowledge of conversation
stuff, but that's how it looks to me at first sight.
Don't get me wrong, I very much like the new feature, but if I'm
correct, there should be a button to enable/disable this feature.

 ciao
      Joerg

-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.