David Meagher wrote:
Hi,
I've been tasked with spec'ing a capture analysis machine.
It will be used to do analysis of multiple 500mb capture's.
Can some one suggest a spec for a desktop pc to view these on?
Is ram more of an issue than CPU, or perhaps a sata/raid storage?
My laptop (1.6ghz pentium M with 512mb) is just toooo sloooooooooow.
You need RAM to keep Wireshark running (especially with large
captures)--it will abort if it runs completely out of memory (including
swap space). I've read that others use a general rule of having 10 (??)
times the size of the capture file in RAM; personally when I have a
doubt about the size of my capture file, I load it on a machine with 16
Gb of RAM, that's usually enough for me. For some suggestions on
limiting Wireshark's memory usage, see:
http://wiki.wireshark.org/KnownBugs/OutOfMemory
As for CPU power, it just depends on how long you want to wait... :-)