Wireshark · Ethereal-dev: Re: [Ethereal-dev] Statistics Counts

["Guy Harris" <gharris@xxxxxxxxx>]

S Faizi said:
> How are the statistics counts updated?

"capture_pcap_cb()", in "capture.c", has a "switch" statement which,
depending on the link-layer type of the capture, calls a "capture_"
routine for that link-layer type.  That routine looks as the packet type
and, based on that, calls other "capture_" routines; those routines update
those counts.

Note that these routines do *NOT* do the sort of detailed packet analysis
that the Ethereal dissectors do; this is entirely deliberate and
intentional, so that you don't spend a lot of time processing each packet
as it arrives and thus run a lesser risk of spending more time processing
the packet than the inter-arrival time of the packets and thus run a
lesser risk of dropping packets.