On Wed, Oct 20, 2010 at 04:07:22AM -0700, Guy Harris wrote:
>
> On Oct 20, 2010, at 3:42 AM, cco wrote:
>
> > why is wireshark so slow when loading up >500 MB pcaps?
>
> Are you saying that the time taken to read a file, as a function of the size of the file, is discontinuous, with a jump at about 500 MB?
cristian: hi! I have not tested with continous values of file sizes (I
hope this is not becoming too mathematical...)
what I wanted to say was that large files take far too long to get
loaded by wireshark. (2gb file takes 45 minutes...)
and even when it gets loaded it will take even longer (for
example) to trace the sip voip calls.
>
> If so, it might be that the memory used by Wireshark for the file (per-packet data structures, reassembled packets, text for columns that aren't generated on the fly, etc.) becomes large enough that your machine starts paging.
>
> > is there any configuration trick to speed this up?
>
> If you're paging:
>
> Make sure you're running Wireshark 1.4.0 or later - *no* columns can have their text generated on the fly in earlier releases, but some can in 1.4.0.
cristian: do you mean the gui is that so slow?
>
> Turning off packet reassembly for various protocols *might* help as well.
> ___________________________________________________________________________
> Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe