Re: TCP dissect issue when app-level message spans multiple TCP packets

[Guy Harris <guy () alum mit edu>]

On May 5, 2011, at 1:49 PM, John Sullivan wrote:

> I think knowing these things is pretty useful for the prospective
> dissector writer - it certainly gives a better feel for the dynamics
> of dissection and may help optimize the places where expensive work is
> done - so I think that section of the documentation ought to be
> expanded to mention it.

Actually, what dissector writers need to know is "do not make any assumptions whatsoever about whether the tree 
argument will be null or not on any pass through the packets, as it's subject to change from release to release, from 
user configuration to user configuration, and from program to program (dissectors currently run in Wireshark *and* 
TShark)".
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe