Wireshark-dev: Re: [Wireshark-dev] Detecting capture file load finished in a C plugin
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 20 Dec 2015 19:48:09 -0800
On Dec 20, 2015, at 3:58 AM, Paul Offord <Paul.Offord@xxxxxxxxxxxx> wrote:

> I'll check again the business about the dissector being called twice during a capture file load (actually I've written a postdissector) in case there isn't a bug.  I've written a LUA postdissector in the past and I know that it gets called twice for every frame; once with visited false and then in a second cycle through the frames with visited set to true.

Is this with the Qt or GTK+ UI?  The first dissection happens when the file is read; perhaps one or the other of the list widgets makes a pass over all the rows in the list after the list has been constructed, and causes a second dissection to happen for each row - i.e., for each packet - in order to fetch the column data, even though it's only going to display some of those rows.  (Or are you seeing this with a small capture file, so that all packets show up in the display?)