Wireshark · Ethereal-dev: [Ethereal-dev] Split the capture-child into it's own program?!?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Hi List!

While looking at the current capture handling and the recent command 
line problems, I'm asking myself if it would be a good idea to split the 
capture-child into it's own (little) program.

Currently we start another Ethereal application to do the capture. So 
the Ethereal start code needs to handle two different cases: the normal 
Ethereal start and the capture-child start, which makes the start code 
much more complicated than it has to be.

In addition, we do a lot of stuff for the capture-child we don't need to 
do (which takes time and memory): register the dissectors (and need 
memory for all of them), register plugins, and a lot more.

I see some real advantages to have a separate capture-child application:

- a small stand-alone capture application without all the Ethereal 
dissection overhead, but with fine things like the ringbuffer feature
- faster capture start, as loading the small stand-alone program should 
be much faster
- need a lot less memory for the capture-child (currently Win32: ~10MB 
and probably still rising with every dissector)
- don't need to init a lot of unrequired stuff (dissectors, plugins, 
...) for a capture start
- we might be able to drop the requirement of GTK completely for the 
capture child (when the capture info window isn't needed)
- cleanup of the main Ethereal startup code (which is quite complicated 
right now)

And some disadvantages:

- some work to do in main.c and elsewhere
- need to carve the current capture related parts from some of the 
"lower level" dissectors (code used to display the "capture info" window 
while capturing)
- probably security problems?


When looking at the above, the advantages are overwhelming to my eye ;-)

Are there still good reasons to have both applications in the Ethereal 
main application that I don't see?
What do other's think?

Regards, ULFL