Wireshark · Wireshark-dev: Re: [Wireshark-dev] Idea for faster dissection on second pas

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

On 10/11/13 00:41, Anders Broman wrote:
> Evan Huus skrev 2013-10-11 01:51:
> > On Thu, Oct 10, 2013 at 6:22 PM, Evan Huus<eapache@xxxxxxxxx>  wrote:
> > > It might be simpler and almost as efficient to have
> > > recently-successful heuristic dissectors bubble nearer to the top of
> > > the list so they are tried sooner. Port/conversation lookups are
> > > hash-tables for the most part and likely won't be made noticeably
> > > faster by caching.
> > The attached trivial patch more-or-less implements the above idea. It
> > isn't easy to bubble dissectors to the very head of the list because
> > we don't have a modifiable pointer, but it was surprisingly easy to
> > bubble them to *second* in the list, which should still be a
> > substantial improvement if there are many expensive heuristics.
> >
> > I don't have any long heuristic captures that I can easily time, but
> > I've run a few short ones and at least it doesn't seem to break
> > anything.
> >
> > Let me know if it helps,
> > Evan
> In the particular case I'm looking at there is mostly no match in the
> heuristics tables except false positives
> the same is true for many of the uint table lookups too as there is RTP
> sent from a tool simulating many

If you're looking mostly at "no match" cases then what about only 
calling heuristic dissectors that are in the (hopefully stored from the 
1st pass) protocols-in-frame list?  Maybe it would need to not be a list 
if we're looking at it that often...