[Thoralf Will <thoralf@xxxxxxxxxxx>]

Hi,

to post-analyze dos/ddos attacks against our servers I've written a 
script that constantly checks the incoming traffic and in case of an 
increased packet rate/traffic count it starts a tcpdump to store the 
data for later investigation.

While analyzing those packets I've noticed that certain archives take a 
significantly longer amount of time to load the conversations screen, 
some even need extremely long time. DNS lookups are generally disabled, 
so this is not the problem.

Does a known issue with ethereal and the conversations part exist or is 
there anything that I can do to speed up this process? The recorded 
archives usually consist of chunks of 50.000 packets and the common 
attack is a udp-flood with huge and highly fragmented packets to fill up 
the bandwidth.
(Summary loads in no time and even filter rules apply are really fast.)

Thanks in advance,
Thoralf