Ethereal-dev: Re: [ethereal-dev] Modifying the packet buffer in dissectors

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 14 Aug 2000 14:39:11 -0700 (PDT)
> Is there a clean way to change the contents of the packet buffer

I'd copy the buffer and change that instead.  I could imagine that in
the future the buffer might, in some cases, be part of an mmapped region
of a capture file; if so, it'd be mapped MAP_SHARED (on UNIX, and the
equivalent on Win32) and read-only (mapping it MAP_PRIVATE would mean
a copy-on-write *and* would mean that the next fetch of the packet would
get the modified data).

> As
> of now I cannot see a mechanism in the tvbufs that would allow
> this except for creating a new real data tvbuf which will generate 
> even more overhead in the costly decryption dissector.

Is the extra overhead of creating a new tvbuff very large compared to
the decryption overhead?  Or would it just be in the noise?