Wireshark · Wireshark-dev: Re: [Wireshark-dev] Protocol Col / Info col error

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 31, 2009, at 1:22 PM, vinayak kamath wrote:

> When i load the PCAP file pinfo->cinfo value is never null but when  
> i click on any of the lines(my own porotocol message)
>  on GUI the debud printfs shows the value as null

That's currently the correct behavior.

When you load the file, Wireshark currently has to generate all the  
columns for each packet as it reads the packet, so it passes a non- 
null pinfo->cinfo value on the first dissection.

When you click on the packet, Wireshark currently doesn't need the  
columns - the text for the columns has been stored in the GUI widget  
that displays the packets - so it passes a non-null pinfo->cinfo value.

This may change at some point in the future, if we make random access  
to packets faster (that would require some work to support on  
compressed files, but is probably doable) and make the widget for the  
packet list pane call the Wireshark code to get the columns when it  
needs to display them.  That would make loading the file faster, and  
significantly reduce the memory requirements for a capture file.