On Aug 10, 2006, at 1:52 PM, Stephen Fisher wrote: > I see what you're saying. The only information I'm keeping for the > duration of the conversation
For the duration of the conversation? I.e., once you see the last packet of the conversation, it's not needed in order to correctly re-dissect any of the packets in the conversation? (BTW, keeping a small data structure around as long as a capture file is open, if that's necessary in order to correctly re-dissect a packet, is OK - remember, once the first pass over the packets in a capture is complete, any packet in the capture can be accessed in any order at any time, so, once the first pass is done, there is *no* guarantee that, if packet N of the capture is being dissected, packet N-1 of the capture was the packet dissected immediately before that.) _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
