Wireshark · Wireshark-dev: Re: [Wireshark-dev] Display Filter Macros of currently selected packet fields?

["Luis EG Ontanon" <luis.ontanon@xxxxxxxxx>]

No, It does not *select* the incoming  packets, it leaves the last
selected packet (frame 1 stays selected if none is selected).
cf_select_packet() needs user-interaction to get invoked (either a
mouse click or using the arrows) so it does not pose a heavy load
(unless the user can click or type at a very-very high rate).

Luis

On 7/31/07, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
> Luis EG Ontanon schrieb:
> > Committed revision 22427.
> >
> > When a packet is selected, it creates a cache (hash table) of all the
> > usable fields (FT_NONE and FT_PROTO are not, some of those had no
> > value and crashed so I just avoided them)  marking duplicates as
> > unusable,  if a (user defined) macro name is not found it looks for it
> > in the cache.
> >
> Won't this cache *significantly* slow down "Update of packet list in
> real time"?
>
> It will newly select packets all the time while new packets are rushing
> in and the list is scrolling down, or do I miss something here?
>
> Regards, ULFL
> _______________________________________________
> Wireshark-dev mailing list
> Wireshark-dev@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
>


-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan