Wireshark · Ethereal-dev: [ethereal-dev] Protocol-only display filters

[Gilbert Ramirez <gram@xxxxxxxxxx>]

It is likely that the majority of display filters used
for colorization will be "protocol existence" filters,
that is, "smb" or "ipx" or "tcp", checking only the
existence of a protocol in a packet.

It might be worthwhile to optimize for that case. If
you can figure out that the dispay filter only checks
the existence of a protocol, you can check for that
protocol while running dissect_packet() with tree == NULL,
that is, when populating the CList. That will save
*a lot* of time, because a full proto_tree won't have
to be constructed for each packet just to check
for the existence of a protocol, for colorization.

This separate protocol-checking method would be separate
and distinct from the dfilter routines. But, it would
help the "Vendor Color" Ethereal theme mentioned
previously. :)

--gilbert