When running a capture or when opening a captured file, wireshark dissects it to build the display tree and all. What I also observed is that when I select a packet in the display it once again calls the dissector to analyze the packet. This seems to be a little wasteful since the analysis done earlier is discarded.
It also poses a problem for streaming protocols like RTMP where what was seen earlier decides how to make sense of the current data. For example, RTMP has header optimizations by which message length is sent only once and subsequent RTMP chunks use the length sent earlier. Is there a way to turn this off and always use the initial analysis? Thanks, Sudarshan ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
