This is our old Q&A Site. Please post any new questions and answers at

I have a small pcap with just one packet in it. I also have a Lua dissector that analyzes the protocol used in the packet. There is a line of debug info in the dissector. The debug info should only be output once if the packet is analyzed once.

To my surprise, when I click on the pcap in Wireshark, the debug info is output multiple times. In Mac it is output 18 times, and in Windows, it is output 3 times.

Why is this?

asked 01 Apr '14, 07:58

YXI's gravatar image

accept rate: 0%

First the entire file is read is read in sequence then packets are read "by the GUI" to display them. If a packet is "clicked" it will be re-read if the packet list is scrolled the packet the packets that becomes vissible will be re-read. Why the MAC (Qt?) version reads them 18 times I don't know.(There is a bug report about that.)

permanent link

answered 01 Apr '14, 09:13

Anders's gravatar image

Anders ♦
accept rate: 17%

Why the MAC (Qt?) version reads them 18 times I don't know.

don't they claim to have the better (best) system? So, I guess they do everything better than windows, even analyzing a frame in Wireshark. And what is better than 3 times? Of course: 18 times ;-))

(02 Apr '14, 13:57) Kurt Knochner ♦

But it only takes the Mac the same time to analyze it 18 times, as it takes Windows to analyze it 3 times. ;)

(02 Apr '14, 14:11) Hadriel

dammit .....

(02 Apr '14, 14:17) Kurt Knochner ♦

What about Linux? I bet those smart guys can make in one shot and less than half the time, it takes to boil an egg in the center of the sun.

(02 Apr '14, 14:18) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 01 Apr '14, 07:58

question was seen: 1,454 times

last updated: 02 Apr '14, 14:21

p​o​w​e​r​e​d by O​S​Q​A