2 Mar 2009 00:31
Re: Splitting packet_info struct for performance reasons?
On Mar 1, 2009, at 12:45 PM, Kaul wrote: > I was astounded with the huge size of packet_info structure. I > believe in 99% of the cases, there is no need for many of the fields > within the structure. Wouldn't it make sense, for performance > reasons, to leave the most usable ones within it, and create a > pointer to an extra structure with the other, less commonly used > stuff. I'm pretty sure it'll save memory and probably improve > performance, but would require some changes and complicate a bit the > programming. Thoughts? packet_info has become the grab bag of packet information in Wireshark (heck, that dates back to when it was still called Ethereal). There are several issues here: 1) we do most columns in the packet list by saving the binary information and formatting it only when we add the packet to the list (to avoid formatting strings in one dissector only to replace that string in a higher-layer dissector - that actually did save some CPU time); 2) we use packet_info to handle "dissect as", so that the GUI can determine to which flow (at a given protocol layer) the packet belongs; 3) we might also use this as a way to pass information between dissectors, e.g. addresses and ports. The column handling needs some rethinking, given that:(Continue reading)
RSS Feed