Wireshark · Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13

[Ambarisha B <b.ambarisha@xxxxxxxxx>]

Hi Anders,

On Sun, Apr 21, 2013 at 2:05 AM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:

Not necessarily if we can hide the fact in the tvb or reassembly functions.

But the dissectors create the tvb from the reassembled data. So, if we define a new type of tvbuff which has to be used, wouldn't that effect the dissectors?

I think the first step is to find out how feasible this idea is and an implementation strategy. gziped files, encrypted files etc may prove the idea not valid.

I understand that feasibility could be a concern in the sense that "we cut down memory usage without *any* loss in performance* because that would depend on how well we can tune the cache. I was thinking that the file backing the tvbuff would be a separate file and not the capture file. In that case, encryption and compression of capture file wouldn't matter. Am I missing something here?

 

Cheers
Ambarisha