I ran Wireshark with a capture file which contains only one LLDP packet. It seems that dissector_lldp is called with the same tvb for multiple times. Why is the dissector called multiple times? (On the other hand, I ran tshark with the same capture file, dissector_lldp is called one time.)
Why is the dissector called multiple times?
Because Wireshark makes one pass over all the packets as it reads in the capture file - and then, if a packet's information becomes visible in the packet summary pane, or is selected so that its information is shown in the packet detail pane, the packet will be dissected again.
We don't keep the dissection around in memory; that would mean, for a large file, that we'd chew up even more memory than we do now. That would cause thrashing when handling that file.
You will have to make sure that any dissector you write, or change, can handle this.
On the other hand, I ran tshark with the same capture file, dissector_lldp is called one time.
That's because TShark only makes one pass over the file...
...unless you run it with the -2 flag, in which case it makes two passes over the file, and the dissector will be called twice.
Thank you for your answer. I will modify my dissector to handle this.
Comments