1,How did the rlc reassemble the code from mac in wireshark? you should tell me the main step of reassemble in wireshark. 2,Is the wireshark malloc memory for each rlc SDU? because when the wireshark decode a big *.pcap,it will occupy a big memory. is the wireshark reassemble the rlc code stream from mac like this step? 1,decode each rlc code and malloc new memory for each rlc SDU. 2,when user click the frame .wireshark will find the rlc SDU's which have the same logical channel id. and then reassemble those ,transport to up level. 3,so for each rlc decode,it need to search the memory which malloced by rlc. if the memory is big, then the time used to decode is long. Thanks! asked 19 Feb '13, 02:15  smilezuzu |
One Answer:
Assuming its UMTS rlc you can read the code of packet-rlc.c to figure out how it's done and see if any improvments can be done. You should probably start out by trying the development version to see if there has been improvments done allready. answered 19 Feb '13, 08:15  Anders ♦ |
how to get the development version?
http://www.wireshark.org/download.html#development_release
Or http://www.wireshark.org/download/automated/
I have download the development version,and compile it.but the rlc reassemble is not so good.is still bad.
any body help me to fix the rlc reassemble process？