Wireshark-dev: Re: [Wireshark-dev] Idea for faster dissection on second pas
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Evan Huus <eapache@xxxxxxxxx>
Date: Sat, 12 Oct 2013 20:20:14 -0400
On Fri, Oct 11, 2013 at 12:41 AM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:
> In the particular case I'm looking at there is mostly no match in the
> heuristics tables except false positives
> the same is true for many of the uint table lookups too as there is RTP sent
> from a tool simulating many
> users with many IP/port combinations making up a huge portion of the
> packets.
>
> Regards
> Anders

Now that I've actually looked at the callgrind profile you attached,
it seems the main slowdown is all of the tvb length checks we are
doing in the NULL tree case. This was the patch Jeff added to stomp
out a whole class of infinite loops.

I've checked in a few tweaks that help marginally, but I'm not sure
what else we can do. The checks are important and we're not doing them
in an obviously inefficient way. It does mean though, that
dissector-level "if (tree)" checks are more effective optimizations
than they used to be, if added with care.

Cheers,
Evan