Yes, tshark generally requires much less memory, from need not to
build the packet list (which comprises a very significant portion of
the Wireshark memory usage) and some of the structures not maintainted
through multiple passes. It's quite powerful, and I use it in many
cases specifically because of capture size.
-Ian
On Sat, Jul 10, 2010 at 10:36 AM, Bryan Hoyt | Brush Technology
<bryan@xxxxxxxxxxx> wrote:
> Have you looked at tshark at all? ...
> I don't know for sure, but I'd assume that it uses significantly less memory
> than Wireshark, because I don't think it would try to load the whole file at
> once.