Guy Harris wrote:
This would also, in theory, allow us to have some mechanism for showing
all the Info layers for a given packet, although the main questions that
raises are what the UI should be. Should the packet list become a tree
view, so that you can open up the view for an individual packet, with
all the layers shown below what presumably would be the topmost layer?
Should there be an "open all" option?
Note that, with the current implementation of the packet list, showing
all those layers would *SIGNIFICANTLY* increase the memory required for
a capture file and probably perhaps less significantly, but still
significantly, increase the time taken to read in a capture file.
That's because, with the CTree widget, we would have to allocate an
entry not only for each packet, but for each Info layer for each packet,
and the strings for the Info columns, as least, would have to be
allocated and saved as part of the CTree widget - that widget can't call
back to a dissector and generate column values on the fly when it needs
to display them.
(Merely having a stack of them wouldn't do this - it'd increase memory
use somewhat, but the stack would be discarded after we're done filling
in the columns, and the increase in memory use would decrease cache
locality, so there'd probably be a CPU time hit as well.)
That doesn't handle the case where you have, for example, protocol X,
running atop TCP, with protocol Y running atop protocol X, with multiple
protocol-X packets, each containing a protocol-Y packet, in a TCP segment.
We could do that by appending to the "stack" every time a new dissector
is called, so that'd be
v Row for the last protocol Y packet
Row for the link layer
Row for IP
Row for TCP
Row for the first protocol X packet
Row for the first protocol Y packet
Row for the second protocol X packet
Row for the second protocol Y packet
We might want to keep the top-level Info column, and the "stack" Info
column, separate, with the dissector being able to modify them
separately, so we could have
v Row summary for all protocol Y packets
Row for the link layer
Row for IP
Row for TCP
Row for the first protocol X packet
Row for the first protocol Y packet
Row for the second protocol X packet
Row for the second protocol Y packet
or, perhaps as an option
Row for the first protocol Y packet
v Row for the second protocol Y packet (which is the last one in this
example)
Row for the link layer
Row for IP
Row for TCP
Row for the first protocol X packet
Row for the first protocol Y packet
Row for the second protocol X packet
Row for the second protocol Y packet
with the row for the first protocol Y packet having the packet number
and time stamp fields and all the other rows having that column blank.
