Ethereal-dev: Re: [Ethereal-dev] Can I prevent a called dissector from changing the summary wi

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 11 Jun 2003 15:45:54 -0700
On Wed, Jun 11, 2003 at 01:20:23PM -0700, Jeff Rizzo wrote:
> Hm.  I did it the way I did because the example (from README.developer)
> seemed to indicate that I should.

The comment in the sample needs to be fixed to make that clearer.

> So, what you're saying is that 
> I should always dissect the entire packet first, since I basically
> need to in order to decide which pieces to pass off to the
> subdissectors?  Whether or not the protocol tree is built?

Whether you need to dissect the *entire* packet to know which piece to
pass off to the subdissectors depends on the protocol.

It is not the case that for *all* protocols you need to do that.  You
only need to dissect fields that tell you

	1) where the next-layer protocol's data begins;

	2) which next-layer protocol has to be called.

> I can certainly do that, but the comments in the example made me
> concerned about performance.

Yes, that means the dissector needs to do more work even when not
generating the protocol tree, but getting the right answer more slowly
is better than getting the wrong answer more quickly here.