Wireshark · Wireshark-dev: Re: [Wireshark-dev] How many tree items is too many?

["ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>]

i have several large DCERPC pdus that contain hundreds of thousands of
items when reassembled and dissected.



On 8/22/06, Gilbert Ramirez <gram@xxxxxxxxxxxxxxx> wrote:
> Make the limit high, to guard against infinite loops. Not too low, as
> if we were trying to impose some design on the dissector. So even  a
> number like 10,000 is good. That will guard against infinite loops,
> and [hopefully] won't break a good dissector.
>
> --gilbert
>
> On 8/22/06, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:
> > Would it make sense to place a maximum limit on the number of items in a
> > protocol tree?  Right now, if a dissector tries to add a large number of
> > items to the tree (e.g. during an infinite loop) Wireshark will happily
> > oblige until the system runs out of memory.
> >
> > If so, what's a good number?  500? 1000?
> > _______________________________________________
> > Wireshark-dev mailing list
> > Wireshark-dev@xxxxxxxxxxxxx
> > http://www.wireshark.org/mailman/listinfo/wireshark-dev
> >
> >
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev