Home page logo
/

wireshark logo Wireshark mailing list archives

Re: Cashe column operations to "end of packet" and only execute the visible ones to save CPU
From: Anders Broman <anders.broman () ericsson com>
Date: Tue, 11 Mar 2014 12:14:24 +0000



-----Original Message-----
From: wireshark-dev-bounces () wireshark org [mailto:wireshark-dev-bounces () wireshark org] On Behalf Of Evan Huus
Sent: den 11 mars 2014 13:06
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Cashe column operations to "end of packet" and only execute the visible ones to save CPU

That sounds like it might be a good idea. Do you have captures where the col_ API is taking a substantial amount of 
time?


I could probably find something to share privately, not sure if I have something that can be publicly shared, perhaps 
we could profile one of the sample SIP captures?
It was a while since I did the profiling but as I remember the trace had VLAN tags which was costly to no immediate use.

I expect the most expensive part of the col_ API is probably the formatting calls, but I'm not sure how we'd cache 
those. I expect we'd have to do the formatting immediately and then cache the >resulting string, so I'm not sure how 
much benefit that would provide over just formatting in place.

I was hoping someone more familiar with C than me would come up with a way of "cashing the execution" of the function 
:-)
Yes the formatting calls are the expensive ones.

Worth exploring though.

Evan

On Tue, Mar 11, 2014 at 5:20 AM, Anders Broman <anders.broman () ericsson com> wrote:
Hi,

How about this idea?

Would it be possible to stack the col..() operations and just execute 
the relevant ones to save on CPU? Currently we overwrite the data as 
we work our way through the packet

Until we hit a col_set_fence() then we start to overwrite the stuff 
after the fence again. One problem might be exceptions - other?



Best regards

Anders




___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             
mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault