Wireshark-dev: Re: [Wireshark-dev] Subdissectors for HTTP connect traffic
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 10 Aug 2006 16:56:08 -0700

On Aug 10, 2006, at 1:52 PM, Stephen Fisher wrote:


I see what you're saying.  The only information I'm keeping for the
duration of the conversation


For the duration of the conversation?
I.e., once you see the last packet of the conversation, it's not needed in order to correctly re-dissect any of the packets in the conversation?
(BTW, keeping a small data structure around as long as a capture file is open, if that's necessary in order to correctly re-dissect a packet, is OK - remember, once the first pass over the packets in a capture is complete, any packet in the capture can be accessed in any order at any time, so, once the first pass is done, there is *no* guarantee that, if packet N of the capture is being dissected, packet N-1 of the capture was the packet dissected immediately before that.)