Yes it is slow.
However, tap listeners provide a filter string to control which packets
they want to
tap and in order to evaluate the filter, teh only method to do so is to
first dissect
the full packet before the filter can be evaluated.
It is slow by design. That is why the filtering works so well-is so
accurate.
To get all packets in the entire capture
create a tap listener that taps the "frame" tap )every single packet has
"frame"
and specify NULL or "" as the filter.
----- Original Message -----
From: "Lars Ruoff (Alplog)"
Sent: Thursday, May 15, 2003 5:14 PM
Subject: Re: [Ethereal-dev] tap registration and packet traversal
> Thank you.
>
> In a more general way of speaking, what is the best way to traverse all
> packets?
> I took the tap_rtp as an example, and what is done there is that a tap
> listener is registered,
> then redissect_packets is called, so that the tap function is called for
> each packet and finally the tap is unregistered again.
> However this is so slow, since all the protocol tree is being
reconstructed
> again (is it?), although there is not really a need for it.
> Is there a faster method?
> It would be nice to have a version of redissect_packets, wich calls only
the
> taps but not the proto-dissectors.
>
> Lars.
