Re: [Wireshark-dev] one possible way to speed up filtering

Hello, didier wrote: I updated the wiki with patches against the latest revision (28327). Thanks. I'll give it a spin. -- Best regards, Kovarththanan Rajaratnam ___ Sent via:Wireshark-dev mailing list

Re: [Wireshark-dev] one possible way to speed up filtering

Hello, didier wrote: Hi, Le mardi 24 mars 2009 à 19:46 +0800, yami a écrit : Hi I've tried Didier's patch in Windows (compiled in MSVC 2005 Express with a few code tweak). Great, I think you are the first on Windows, can you mail me your change? (I haven't a Windows tool chain). I wanted

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le dimanche 10 mai 2009 à 15:22 +0200, Kovarththanan Rajaratnam a écrit : Hello, didier wrote: Hi, Le mardi 24 mars 2009 à 19:46 +0800, yami a écrit : Hi I've tried Didier's patch in Windows (compiled in MSVC 2005 Express with a few code tweak). Great, I think you are the

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le lundi 23 mars 2009 à 20:54 +0100, Joerg Mayer a écrit : On Mon, Mar 23, 2009 at 06:29:11PM +0100, didier wrote: There's still some small stuff which could go but It would only improve wireshark speed by 20-40%, I'm not sure it's worth the time. It most likely is. As usual it's a

Re: [Wireshark-dev] one possible way to speed up filtering

Hi I've tried Didier's patch in Windows (compiled in MSVC 2005 Express with a few code tweak). It is really fast. I hope one day it can come to trunk. On Tue, Mar 24, 2009 at 1:29 AM, didier dgauthe...@magic.fr wrote: Hi, Le lundi 23 mars 2009 à 10:40 +0800, yami a écrit : I'm

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le mardi 24 mars 2009 à 19:46 +0800, yami a écrit : Hi I've tried Didier's patch in Windows (compiled in MSVC 2005 Express with a few code tweak). Great, I think you are the first on Windows, can you mail me your change? (I haven't a Windows tool chain). About your patch, two small

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le lundi 23 mars 2009 à 10:40 +0800, yami a écrit : I'm interested in: 1. how do you do profiling? mainly with: valgrind --tool=callgrind and kcachegrind I also did some runs with cache profiling tools. 2. which modifications contribute most? Same as your stuff, try very hard to not

Re: [Wireshark-dev] one possible way to speed up filtering

On 3/23/09, didier dgauthe...@magic.fr wrote: There's still some small stuff which could go but It would only improve wireshark speed by 20-40%, I'm not sure it's worth the time. Even that would be worth it, I think ... A big change is the per packet protocols bitfield but even if it's in

Re: [Wireshark-dev] one possible way to speed up filtering

On Mon, Mar 23, 2009 at 06:29:11PM +0100, didier wrote: There's still some small stuff which could go but It would only improve wireshark speed by 20-40%, I'm not sure it's worth the time. It most likely is. A big change is the per packet protocols bitfield but even if it's in rather good

Re: [Wireshark-dev] one possible way to speed up filtering

Another way to greatly speed up filtering would be to pick up and clomplete the work to make it possible to use ep_* memory for all field types when dissecting a packet. When wireshark dissects a packet it performs a massive amount of malloc()/free(). This was partially addressed when I added

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le dimanche 22 mars 2009 à 02:13 +0800, yami a écrit : Hi Didier, Thank you for trying the patch :) and all the good comments given. I've attached a new patch to the wiki. Please see my detailed reply below. - If compiled without NDEBUG defined I get a failed

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, On Mon, Mar 23, 2009 at 5:24 AM, didier dgauthe...@magic.fr wrote: I'll try to merge it with http://wiki.wireshark.org/Development/Optimization , this version is already able to find 2000 DNS packets inside 7 millions packets in 1 second. Amazing! It looks that you've done several big

Re: [Wireshark-dev] one possible way to speed up filtering

Hi Didier, Thank you for trying the patch :) and all the good comments given. I've attached a new patch to the wiki. Please see my detailed reply below. On Fri, Mar 20, 2009 at 6:30 AM, didier dgauthe...@magic.fr wrote: Hi, Le mercredi 18 mars 2009 à 23:05 +0800, yami a écrit : Thanks,

Re: [Wireshark-dev] one possible way to speed up filtering

Yami, I know it was only an example, but your DNS is only over UDP is a bad one. DNS can use TCP for any query/response, either when the response is bigger than a 512byte PDU, or when doing AXFR zone transfers. But in princple the idea of preventing redundant dissection is great. I often see

Re: [Wireshark-dev] one possible way to speed up filtering

yami wrote: Thanks, I've written a page in Wiki: http://wiki.wireshark.org/Development/FastFiltering On a side note, I've had an idea brewing that's along the same lines that I'll throw out there for comment. I often work with fairly large capture files (100MB) and running filter after

Re: [Wireshark-dev] one possible way to speed up filtering

Hi Jason, I think your idea is that we have two threads (virtually, or actually), one is for displaying packets, another for processing all packets. The first thread only processes enough packets for display, such as 3 times of number of packet list pane. This should be able to improve user

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le mercredi 18 mars 2009 à 23:05 +0800, yami a écrit : Thanks, I've written a page in Wiki: http://wiki.wireshark.org/Development/FastFiltering Nice work. - If compiled without NDEBUG defined I get a failed assert: epan/dfilter/wslimmat.c :1680 : fix_variables: v-assignment == v

Re: [Wireshark-dev] one possible way to speed up filtering

Hi, Le mardi 17 mars 2009 à 22:14 +0800, yami a écrit : Hi dev, I have implemented a prototype to speed up interactive filtering. The key idea is to reuse previous display information. (Is there anyone interested in this idea?) Sure, can you open a wiki page?