This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Has anyone tried real-time packet analysis using wiresharks GUI with high volumes of traffic(>1Gbps)? Is this even possible with Wireshark?

asked 22 May '12, 09:26

kfryklund's gravatar image

kfryklund
1334
accept rate: 0%

edited 22 May '12, 17:38

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


if you say > 1 GBit/s. Do you mean 10 GBit/s? If so, there have been talks about this at several sharkfest events:

http://www.google.de/#hl=de&site=&source=hp&q=sharkfest+10+GBit&btnK=Google-Suche&oq=&aq=&aqi=&aql=&gs_l=&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=abbb4046b845e521&biw=1440&bih=754

Maybe someone here has even personal experience with 10 GBit analysis.

Regards
Kurt

permanent link

answered 22 May '12, 10:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 May '12, 10:16

Thank you for the suggestions. I'm capturing at 10Gbit/s (but I have the ability to capture up to 40Gbit/s). I already have an appliance that can handle 20Gbps of traffic capture, but I don't have a way to analyze the realtime traffic with Wireshark.

Based on the sharkfest events, wireshark builds there own appliances (up to 7Gbps capture/record), but I still can't tell if the wireshark user is capable of monitoring/analysis of large amounts of realtime traffic as it's being captured.

(22 May '12, 12:07) kfryklund

You say:

is capable of monitoring/analysis of large amounts of realtime traffic as it's being captured.

Why do you need to analyze the data while it is being captured (at that speed)?
What are you looking for?

(22 May '12, 12:11) Kurt Knochner ♦

BTW: If you try to analyze 10GBit/s traffic in realtime in wireshark (gui or tshark), you will end up with enormous memory consumption in a very short period of time. 10Gbit/s is roughly 1Gbyte/s data. Wireshark builds internal data structures to store that data in memory. Internal memory requirement is somewhat larger than the raw captured data. So, within just 10 seconds you would end up with >> 10 GByte RAM consumption and it's not getting any better if wireshark runs longer ;-)

So, again: What are you looking for? Maybe there is a better way (if any) to analyze that much data in realtime.

(23 May '12, 10:29) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×100
×12

question asked: 22 May '12, 09:26

question was seen: 5,348 times

last updated: 23 May '12, 10:32

p​o​w​e​r​e​d by O​S​Q​A