I have some issue with the dissector going over my packets more than once.
There's a legitimate reason to go over *some* packets more than once - if I
have more than a single PDU in a packet (or a reassembled one), that's
fine. But it just seems that it goes over all packets. I'm trying to fight
it
This is done by design. Wireshark uses a 2-stage dissection to be able to
stuff like the cross-reference of request/response relationships or
reassembly. As you cannot do this without starting the dissection we need
to go over every packet.
There is no way to avoid that, your dissector should not
On Thu, May 22, 2025 at 11:22 AM Yaniv Kaul via Wireshark-dev <
wireshark-dev@wireshark.org> wrote:
> I have some issue with the dissector going over my packets more than once.
> There's a legitimate reason to go over *some* packets more than once - if
> I have more than a single PDU in a packet (
On Thu, May 22, 2025 at 6:53 PM John Thacker wrote:
> On Thu, May 22, 2025 at 11:22 AM Yaniv Kaul via Wireshark-dev <
> wireshark-dev@wireshark.org> wrote:
>
>> I have some issue with the dissector going over my packets more than once.
>> There's a legitimate reason to go over *some* packets more
Thanks for the quick response, comments below.
On Thu, May 22, 2025 at 6:45 PM Roland Knall wrote:
> This is done by design. Wireshark uses a 2-stage dissection to be able to
> stuff like the cross-reference of request/response relationships or
> reassembly. As you cannot do this without startin
On Thu, 22 May 2025, 21:20 John Thacker, wrote:
> On Thu, May 22, 2025 at 12:49 PM Yaniv Kaul via Wireshark-dev <
> wireshark-dev@wireshark.org> wrote:
>
>>
>>
>> On Thu, May 22, 2025 at 6:53 PM John Thacker
>> wrote:
>> This is done for several reasons. It is done to consume less memory, not
>>
On Thu, May 22, 2025 at 2:55 PM Yaniv Kaul via Wireshark-dev <
wireshark-dev@wireshark.org> wrote:
>
>
> On Thu, 22 May 2025, 21:20 John Thacker, wrote:
>
>> I don't understand what you mean. How would you do that? If you mean
>> something like on the same pass through all the frames, then the TC
On Thu, May 22, 2025 at 10:26 PM John Thacker wrote:
> On Thu, May 22, 2025 at 2:55 PM Yaniv Kaul via Wireshark-dev <
> wireshark-dev@wireshark.org> wrote:
>
>>
>>
>> On Thu, 22 May 2025, 21:20 John Thacker, wrote:
>>
>>> I don't understand what you mean. How would you do that? If you mean
>>> s
On Thu, May 22, 2025 at 12:49 PM Yaniv Kaul via Wireshark-dev <
wireshark-dev@wireshark.org> wrote:
>
>
> On Thu, May 22, 2025 at 6:53 PM John Thacker
> wrote:
> This is done for several reasons. It is done to consume less memory, not
> having to store all the strings and other information. It is
