Re: Help on packet correlation

[Guy Harris <guy () alum mit edu>]

On May 28, 2018, at 3:39 PM, Craig Jackson <cejackson51 () gmail com> wrote:

> However, it looks like the example suggests the answer, without explicitly stating it: If the VISITED flag is not 
> set, then this is the first trip through the dissector for this packet, and therefore the packets are being processed 
> in order. This would allow it to remember a pending request name in the conversation structure, and use it when the 
> response is handled. It would be useful to have this documented somewhere: "If the VISITED flag is not true, then the 
> packets are being processed in the order they were received."

That should probably be explicitly stated.  Please either submit a bug against the documentation or a Gerrit change.

> The other interesting point is that both iscsi and rpc choose to use trees instead of hashes to store their data. It 
> would be interesting to have the tradeoffs documented, especially with regards to memory overhead.

Yes.  Please submit a separate bug about that.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe