Re: Reduce memory consumption by re-reading data from file for reassembled packets.

[Jeff Morriss <jeff.morriss.ws () gmail com>]

Anders Broman wrote:
> - Store the file pointer in the topmost TVBUFF_REAL_DATA changing the 
> type to something like
>   TVBUFF_REAL_DATA_FROM_FILE to differentiating it from tvb:s not 
> constructed from file data.
>
> - When making sub tvb they'd have the type TVBUFF_SUBSET_FROM_FILE

I think the top-level would also need to store the offset into the file. 
  SUBSET and COMPOSITE TVBs would not have to change at all, except if 
maybe to have a bit that says their backing is persistent.

> - The reassembly routines should then be changed to not store the 
> fragments but rather the file offset
>   and length when all fragments are available and needs to be presented 
> that data is read from file and
>   stuffed into a "reassembled data tvb".  Possibly data should be kept 
> around until the final packet in a reassembly sequence on the first pass 
> for speed.

I had been thinking it would build up composite TVBs using the passed-in 
TVBs.  Since the TVBs would now be "persistent" this would be okay (we 
recently discussed composite TVBs and why they're not used much 
now--basically it's because the underlying TVBs aren't persistent).

> Did I miss something? Feasible?

I don't think so and I think yes.

(I came back from Sharkfest thinking I'd build a prototype of this, but 
you can see how much work I've done on it! :-()
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe