Wireshark mailing list archives
Re: Idea for faster dissection on second pas
From: Jeff Morriss <jeff.morriss.ws () gmail com>
Date: Fri, 11 Oct 2013 10:58:05 -0400
On 10/11/13 00:41, Anders Broman wrote:
Evan Huus skrev 2013-10-11 01:51:On Thu, Oct 10, 2013 at 6:22 PM, Evan Huus<eapache () gmail com> wrote:It might be simpler and almost as efficient to have recently-successful heuristic dissectors bubble nearer to the top of the list so they are tried sooner. Port/conversation lookups are hash-tables for the most part and likely won't be made noticeably faster by caching.The attached trivial patch more-or-less implements the above idea. It isn't easy to bubble dissectors to the very head of the list because we don't have a modifiable pointer, but it was surprisingly easy to bubble them to *second* in the list, which should still be a substantial improvement if there are many expensive heuristics. I don't have any long heuristic captures that I can easily time, but I've run a few short ones and at least it doesn't seem to break anything. Let me know if it helps, EvanIn the particular case I'm looking at there is mostly no match in the heuristics tables except false positives the same is true for many of the uint table lookups too as there is RTP sent from a tool simulating many
If you're looking mostly at "no match" cases then what about only calling heuristic dissectors that are in the (hopefully stored from the 1st pass) protocols-in-frame list? Maybe it would need to not be a list if we're looking at it that often...
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Idea for faster dissection on second pas Anders Broman (Oct 10)
- Re: Idea for faster dissection on second pas Michael Tuexen (Oct 10)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 10)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 10)
- Re: Idea for faster dissection on second pas ronnie sahlberg (Oct 10)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 10)
- Re: Idea for faster dissection on second pas Anders Broman (Oct 10)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 11)
- Re: Idea for faster dissection on second pas Jeff Morriss (Oct 11)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 12)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 10)
- Re: Idea for faster dissection on second pas Jeff Morriss (Oct 11)
- Re: Idea for faster dissection on second pas Anders Broman (Oct 11)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 11)
- Re: Idea for faster dissection on second pas Jeff Morriss (Oct 11)
- Re: Idea for faster dissection on second pas Anders Broman (Oct 11)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 11)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 11)
- Re: Idea for faster dissection on second pas Anders Broman (Oct 12)
- Re: Idea for faster dissection on second pas Evan Huus (Oct 12)