I'm trying to open fairly large pcap files (about 500MB) and they're loading extremely slow. I imagine the reason for this is due to the sheer number of packets. While loading, I noticed that only a single core on my processor is being used (maxed out to 99% utilization). I believe this is my bottleneck since I have plenty of memory. Is there a way to utilize multiple cores when opening pcap files? Can anyone recommend other methods of speeding up the process? Thanks, Keith asked 28 Sep '12, 07:44  kfryklund |
One Answer:
This is the 1M$ question :-) In trunk there is some speedup of loading files, something we are constantly trying to look at. Multi treading of packet dissection is not easy as the dissection of a packets may depend on dissection of a previous packet like reassembly or state or... It has been discussed but no one has come up with a solution yet. answered 28 Sep '12, 08:42  Anders ♦ |
