On Tue, Sep 10, 2002 at 07:09:51AM +1000, Ronnie Sahlberg wrote:
> but epan_dissect_prime_dfilter() has to be called before epan_dissect_run()
Yes, it does - it sets up the protocol tree such that the code to
generate it knows which fields are of interest to filters.
But that still works with my suggestion.
> Can one take both epan_dissect_new() and epan_dissect_run() and move them
> outside the loops and then just leave epan_dissect_prime_dfilter() and
> dfilter_apply_edt() inside the loop?
No, but one can take epan_dissect_new() and epan_dissect_run() and move
them outside the loops, and just leave "epan_dissect_prime_dfilter()"
inside one loop and "dfilter_apply_edt()" inside another loop.
> Something like:
> epan_dissect_new()
> epan_dissect_run()
> loop over all entries:
> epan_dissect_prime_dfilter()
> dfilter_apply_edt()
> end-loop
No, something like
epan_dissect_new()
loop over all entries:
epan_dissect_prime_dfilter()
epan_dissect_run()
loop over all entries:
dfilter_apply_edt()
Two loops, but such is life.
> I assume it is epan_dissect_run() that is the expensive operation that
> actually dissects the entire packet.
Yes.
