Wireshark-dev: [Wireshark-dev] Reducing memory usage by saving fewer time stamps in frame_data
On May 10, 2012, at 1:24 AM, Anders Broman wrote:
> Reduce Memory usage:
> - In frame_data.h it should be possible to cut down on the nstime_t structures by only having abs_ts and the others could be offsets to that or something similar thus saving a couple of bytes per packet.
"Time since first packet" is straightforward to calculate if, for example, the time stamp of the first packet is stored in the capture_file structure for the file.
"Time since previous captured packet" is straightforward to calculate given the current packet's frame_data structure and the previous packet's frame_data structure (which is straightforward to find if you know the current packet's frame number - if the frame number is 1 "time since previous captured packet" is your choice of 0 or "leave it blank because it's inapplicable" and if it's > 1 then it's the value for frame N-1).
"Time since previous displayed packet" is a bit more work - you have to scan backwards through frames until you either hit one with flags.passed_dfilter set or run out of frames (in which case the answer is either 0 or "leave it blank because it's inapplicable").
