 | 1 | initial version |
Wireshark is primarily a packet dissection engine (with a whole lot of fancy stuff around it). That means that whenever it needs data to be represented (e.g. the packet list, or packet details of a packet, or statistics on a capture) it runs the dissection engine with the packets from the capture file in the context required. So even though data structures are maintained to keep track of certain aspects, there's no concept of a database with dissection results. These are produced as needed, when needed.
