2017-08-02 22:00 GMT+02:00 Sultan, Hassan via Wireshark-dev < wireshark-dev@wireshark.org>:
> Here's my scenario : > > I am planning on using the Wireshark parsing engine in two ways : > 1) process massively large captures > 2) process live traffic, hopefully in the long term in a permanent manner > once the memory growth of the engine can be controlled > Did you have a look at https://blog.wireshark.org/2014/07/to-infinity-and-beyond-capturing-forever-with-tshark/ ? > > In both cases, my automation does not care about any experts at all, it > only needs the field information (length/offset/name/hierarchy/encoding...) > so these experts are consuming memory for nothing in our case. > > As Wireshark evolves, new dissectors get added, which might add new > experts, and not having a global setting to turn them off would force us to > repeatedly search for new experts appearing, which is not a great > experience. > > Now granted, I haven't done measurements on how much memory they consume, > the current experts might not represent much, but it's hard to judge when > experts can appear in any new dissector, one could appear tomorrow that > significantly alters that. > Indeed they probably do not represent much compared to all the fields registered by dissectors. Moreover you are the first one I remember asking for such a feature. Like Jaap, I do not think this is a good move as of today. > Thanks, > > Hassan > > > -----Original Message----- > > From: Wireshark-dev [mailto:wireshark-dev-boun...@wireshark.org] On > Behalf > > Of Jaap Keuter > > Sent: Wednesday, August 02, 2017 11:59 AM > > To: Sultan, Hassan via Wireshark-dev <wireshark-dev@wireshark.org> > > Subject: Re: [Wireshark-dev] Setting to disable all expert info > > > > Are we going to be picking off features one by one to get the memory > footprint > > down? Then I see a long list of preference settings growing from this. > Not > > something I look forward to. > > > > > > On 02-08-17 20:43, Sultan, Hassan via Wireshark-dev wrote: > > > Hi, > > > > > > > > > > > > Am I right in my understanding that there is no global way of > > > disabling insertion of expert information ? > > > > > > > > > > > > Assuming I’m correct, would anyone object to me adding that setting ? > > > That would be another way of lowering memory footprint. > > > > > > > > > > > > Thx, > > > > > > > > > > > > Hassan > > > > > > > > _________________________________________________________________ > > __________ > > Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> > > Archives: https://www.wireshark.org/lists/wireshark-dev > > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev > > mailto:wireshark-dev-requ...@wireshark.org?subject= > unsubscribe > ____________________________________________________________ > _______________ > Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> > Archives: https://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev > mailto:wireshark-dev-requ...@wireshark.org?subject= > unsubscribe >
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
