This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm trying to open fairly large pcap files (about 500MB) and they're loading extremely slow. I imagine the reason for this is due to the sheer number of packets. While loading, I noticed that only a single core on my processor is being used (maxed out to 99% utilization). I believe this is my bottleneck since I have plenty of memory.

Is there a way to utilize multiple cores when opening pcap files? Can anyone recommend other methods of speeding up the process?

Thanks, Keith

asked 28 Sep '12, 07:44

kfryklund's gravatar image

kfryklund
1334
accept rate: 0%


This is the 1M$ question :-) In trunk there is some speedup of loading files, something we are constantly trying to look at. Multi treading of packet dissection is not easy as the dissection of a packets may depend on dissection of a previous packet like reassembly or state or... It has been discussed but no one has come up with a solution yet.

permanent link

answered 28 Sep '12, 08:42

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×55
×3
×2
×1

question asked: 28 Sep '12, 07:44

question was seen: 6,588 times

last updated: 28 Sep '12, 08:42

p​o​w​e​r​e​d by O​S​Q​A