This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Realtime Analysis with WireShark GUI

0

Has anyone tried real-time packet analysis using wiresharks GUI with high volumes of traffic(>1Gbps)? Is this even possible with Wireshark?

asked 22 May '12, 09:26

kfryklund's gravatar image

kfryklund
1334
accept rate: 0%

edited 22 May '12, 17:38

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


One Answer:

1

if you say > 1 GBit/s. Do you mean 10 GBit/s? If so, there have been talks about this at several sharkfest events:

http://www.google.de/#hl=de&site=&source=hp&q=sharkfest+10+GBit&btnK=Google-Suche&oq=&aq=&aqi=&aql=&gs_l=&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=abbb4046b845e521&biw=1440&bih=754

Maybe someone here has even personal experience with 10 GBit analysis.

Regards
Kurt

answered 22 May '12, 10:15

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 May '12, 10:16

Thank you for the suggestions. I'm capturing at 10Gbit/s (but I have the ability to capture up to 40Gbit/s). I already have an appliance that can handle 20Gbps of traffic capture, but I don't have a way to analyze the realtime traffic with Wireshark.

Based on the sharkfest events, wireshark builds there own appliances (up to 7Gbps capture/record), but I still can't tell if the wireshark user is capable of monitoring/analysis of large amounts of realtime traffic as it's being captured.

(22 May '12, 12:07) kfryklund

You say:

is capable of monitoring/analysis of large amounts of realtime traffic as it's being captured.

Why do you need to analyze the data while it is being captured (at that speed)?
What are you looking for?

(22 May '12, 12:11) Kurt Knochner ♦

BTW: If you try to analyze 10GBit/s traffic in realtime in wireshark (gui or tshark), you will end up with enormous memory consumption in a very short period of time. 10Gbit/s is roughly 1Gbyte/s data. Wireshark builds internal data structures to store that data in memory. Internal memory requirement is somewhat larger than the raw captured data. So, within just 10 seconds you would end up with >> 10 GByte RAM consumption and it's not getting any better if wireshark runs longer ;-)

So, again: What are you looking for? Maybe there is a better way (if any) to analyze that much data in realtime.

(23 May '12, 10:29) Kurt Knochner ♦