Wireshark-dev: [Wireshark-dev] Expert Info Performance

From: David Aggeler <david_aggeler@xxxxxxxxxx>
Date: Mon, 23 Feb 2009 23:40:21 +0100
I really like the Expert Info functionality and use it more and more. 
Today I had to analyze a large capture (~200 MB) and here the dialog 
gets to a limit.
Looking at the behavior, it almost looks like it is implemented as a 
tap. Is it really needed to parse the whole capture again, just to have 
the data structures filled? If it is a tap, could be always on? I don't 
think that much memory would be 'lost'. I would pay that price. Am I 
asking for too much?
Since this is core code, I'm not sure whether a dissector coder like me 
is up to the task :-)
David