I'm trying to open fairly large pcap files (about 500MB) and they're loading extremely slow. I imagine the reason for this is due to the sheer number of packets. While loading, I noticed that only a single core on my processor is being used (maxed out to 99% utilization). I believe this is my bottleneck since I have plenty of memory.
Is there a way to utilize multiple cores when opening pcap files? Can anyone recommend other methods of speeding up the process?
asked 28 Sep '12, 07:44
This is the 1M$ question :-) In trunk there is some speedup of loading files, something we are constantly trying to look at. Multi treading of packet dissection is not easy as the dissection of a packets may depend on dissection of a previous packet like reassembly or state or... It has been discussed but no one has come up with a solution yet.
answered 28 Sep '12, 08:42