Home page logo

wireshark logo Wireshark mailing list archives

Re: Memory consumption in tshark
From: Jakub Zawadzki <darkjames-ws () darkjames pl>
Date: Wed, 28 Aug 2013 08:49:14 +0200

On Tue, Aug 27, 2013 at 05:09:19PM -0400, Evan Huus wrote:
We already do reassembly and a lot of other stateful work in single-pass
mode. The only thing two-pass mode provides is the ability to "see the
future" (for example, saying: this request has a response 5 packets later).

We need two pass also for correct out of order reassembly.
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]