Ethereal-users: [Ethereal-users] Slow Performance with desegmented HTTP? was: Re: Getting a "raw

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Peter Valdemar Mørch <swp5jhu02@xxxxxxxxxxxxxx>
Date: Mon, 20 Sep 2004 16:37:00 +0200
ronnie sahlberg ronniesahlberg-at-gmail.com |Lists| wrote:

You can save the content in binary of any PDU in ethereal by

<snip>

"Export selected packet bytes" and save it to a file.

<snip>
If so, have you tried enabling Edit/Preferences/Protocols/TCP/Allow subdissector to desegment TCP stream 
and all four preferences in
Edit/Preferences/Protocols/HTTP/
When I try this on a 380k capture file (http://demo.capmon.dk/~pvm/postReply.pcap PDU # 562 - the data I actually really want), it takes 5 progress popups and 8 minutes to get there on my 2GHz, 512MB WinXP machine and > 10 minutes on my 1.6GHz 256MB RedHat 9 machine. (Remember to enable the options under Protocols/TCP and Protocols/HTTP as mentioned above).
Seems to me desegmenting 380k and reassembling some text should be a little faster than that, or what? 

Peter

--
Peter Valdemar Mørch
http://www.morch.com