Ask Your Question
0

Why is a dissector called multiple times?

asked 2019-03-08 00:21:04 +0000

kawakami gravatar image

I ran Wireshark with a capture file which contains only one LLDP packet. It seems that dissector_lldp is called with the same tvb for multiple times. Why is the dissector called multiple times? (On the other hand, I ran tshark with the same capture file, dissector_lldp is called one time.)

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-03-08 03:01:23 +0000

Guy Harris gravatar image

Why is the dissector called multiple times?

Because Wireshark makes one pass over all the packets as it reads in the capture file - and then, if a packet's information becomes visible in the packet summary pane, or is selected so that its information is shown in the packet detail pane, the packet will be dissected again.

We don't keep the dissection around in memory; that would mean, for a large file, that we'd chew up even more memory than we do now. That would cause thrashing when handling that file.

You will have to make sure that any dissector you write, or change, can handle this.

On the other hand, I ran tshark with the same capture file, dissector_lldp is called one time.

That's because TShark only makes one pass over the file...

...unless you run it with the -2 flag, in which case it makes two passes over the file, and the dissector will be called twice.

edit flag offensive delete link more

Comments

Thank you for your answer. I will modify my dissector to handle this.

kawakami gravatar imagekawakami ( 2019-03-11 00:28:00 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-03-08 00:21:04 +0000

Seen: 47 times

Last updated: Mar 08