[Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx>]

On linux,   I've had good profiling information in the past from using ./tools/valgrind-wireshark.sh -p -2 <pcap>

You view the resulting *.callgrind file using kcachegrind

Martin

On Fri, May 6, 2022 at 6:42 AM Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

Without having looked at the SMB dissector, there could be a lot of housekeeping going on in the background, w.r.t. keeping track of chunks, searches for file handles to names, etc.Things add up quickly with large files like this.

Jaap

> On 6 May 2022, at 00:42, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:
>
> Hi folks,
>
> I am often handling SMB2 captures with lots of compound requests.
>
> I am looking at one at the moment that has about 300,000 packets in
> it, about half of which are SMB2 requests but they are mostly compound
> requests with three SMB2 requests in each compound:
>
> 1. CREATE some file,
> 2. QueryInfo the Security Descriptor for the file,
> 3. CLOSE the file.
>
> This takes an extraordinary amount of time to load even though I have
> 64GB on that machine. (Around 10 minutes or more.)
>
> Moreover, other captures with a comparable number of packets but no,
> or fewer, SMB compound requests take far less time to load.
>
> Does anyone have any ideas on why this is so?
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)(传说杜康是酒的发明者)

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe