Wireshark · Ethereal-dev: Re: [Ethereal-dev] is cfile.plist at all filled in in tethereal?

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Aug 27, 2002 at 03:39:47PM -0400, Khachaturov Vassilii wrote:
> So what would be the best approach for stats generation in tethereal then?
> Compute it on the fly and update it with each packet callback (in case
> the stats generation is enabled)?

Yes.  That matches Tethereal's one-pass nature.

It might be interesting to see if the protocol statistics could be
computed without building a protocol tree (as all it cares about is
protocols, not all protocol tree items).  If that were done, the
statistics could be computed when reading in the file in Ethereal, and
displaying them wouldn't require another pass through the file.  (They'd
be recomputed when filtering the display, as the statistics apply to the
displayed packets.)

> Or build the packet list and reuse the current code?

No.  That'd require it to make two passes over the capture file (one
pass to build the packet list, and one pass to process the packets in
that list), and require extra memory to store the packet list; it'd also
mean that if we ever made Wiretap work, in sequential-access-only mode,
on pipes, you couldn't get the statistics when reading a pipe.