Wireshark-dev: Re: [Wireshark-dev] TCP dissect issue when app-level message spans multiple TC
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 5 May 2011 14:34:16 -0700
On May 5, 2011, at 1:49 PM, John Sullivan wrote:

> I think knowing these things is pretty useful for the prospective
> dissector writer - it certainly gives a better feel for the dynamics
> of dissection and may help optimize the places where expensive work is
> done - so I think that section of the documentation ought to be
> expanded to mention it.

Actually, what dissector writers need to know is "do not make any assumptions whatsoever about whether the tree argument will be null or not on any pass through the packets, as it's subject to change from release to release, from user configuration to user configuration, and from program to program (dissectors currently run in Wireshark *and* TShark)".