Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 39149: /trunk/epan/dissectors/ /trunk/epan/dissectors/:

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 27, 2011, at 12:56 PM, Jeff Morriss wrote:

> (It does appear that Wireshark does cache the column information; scrolling back or clicking on earlier packets does not result in the column info being rebuilt, even if the dissector is called again.)

Note: that should not be treated as a specification.  It should be treated as an implementation detail subject to change.

Caching the column information takes less memory than generating all column information for all packets when the file is read in and saving it all (as was done with the old packet list), but not caching the information would take even less memory. If the only columns cached are ones displayed, it won't be much less memory, but if sorting on a column means that column's contents, for all packets, are generated and saved, sorting on a column gets expensive.  (I haven't checked, but there's probably no reason that searching for packets with given text in a column needs to cache the column information, so that should, at least in theory, not chew up additional memory.)