Wireshark · Ethereal-dev: Re: [ethereal-dev] The first pass versus later display of frames

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Wed, Apr 12, 2000 at 12:56:58AM +0900, Richard Sharpe wrote:
> Hi,
> 
> is there any reliable way to tell that you are in the first pass decode or
> have been called to redisplay a frame?
> 
> The only thing I can think of is:
> 
>   Check for per-frame info, and if it exists, then you are displaying a 
>   frame after the first pass
> 
>   else, you might be in the first pass, but you might not.
> 
> For some protocols, this does not matter, but for some protocols, this is
> important, at least some of the time.

I've been thinking about consolidating the following two fields in
struct frame_data into a set of bitfields, since they waste a lot of
memory when dealing with lare traces:

  gboolean     passed_dfilter; /* TRUE = display, FALSE = no display */
  char_enc     encoding;  /* Character encoding (ASCII, EBCDIC...) */

I only need one bit for passed_dfilter, and right now only one bit
for encoding, but I'd rather reserve at least two for it, since there
might be UNICODE or some other character encoding in the future.

We could add another bitfield to mark if this the packet
has been visited or not. That would act as your per-frame info.

--gilbert