Wireshark · Wireshark-dev: Re: [Wireshark-dev] Expert Infos are a bit "more official" now!

[Ulf Lamping <ulf.lamping@xxxxxx>]

Stratemeier, Frank schrieb:
> Yo Chris!
>  
> I had the same problem and was just wondering why.
> It seems that "Expert Info" rescans a capture passing no valid tree 
> pointer. "Expert Info Composite" does indeed pass a valid tree pointer!.
> So in my dissector the EIC makes much more sense.
You should not depend on tree!=NULL, as the expert info is NOT ONLY a 
part of the packet tree - but an instance in itself! I've added an 
according note to the wiki page.

When I've implemented the "Expert Info" I've optimized it for 
performance. Unfortunately, the "Expert Info Composite" is not optimized 
- it should NOT pass tree != NULL, as this *significantly* slows down 
the scanning - so this might be changed in the future.

If you scan a 100MB+ trace, you will see the difference.
>  
> You said that the "old" EI will not be available in some future point 
> of time?
>  
If the composite gets the filtering function and is optimized for 
performance, the "old" expert info is obsolete and will be removed.

Having two almost identical dialogs is confusing and therefore not very 
user friendly ...

Regards, ULFL