Re: Memory consumption in tshark

[Jakub Zawadzki <darkjames-ws () darkjames pl>]

On Tue, Aug 27, 2013 at 05:09:19PM -0400, Evan Huus wrote:
> We already do reassembly and a lot of other stateful work in single-pass
> mode. The only thing two-pass mode provides is the ability to "see the
> future" (for example, saying: this request has a response 5 packets later).

We need two pass also for correct out of order reassembly.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe