This is a static archive of our old Q&A Site. Please post any new questions and answers at

How to open large pcap files faster?


I'm trying to open fairly large pcap files (about 500MB) and they're loading extremely slow. I imagine the reason for this is due to the sheer number of packets. While loading, I noticed that only a single core on my processor is being used (maxed out to 99% utilization). I believe this is my bottleneck since I have plenty of memory.

Is there a way to utilize multiple cores when opening pcap files? Can anyone recommend other methods of speeding up the process?

Thanks, Keith

asked 28 Sep '12, 07:44

kfryklund's gravatar image

accept rate: 0%

One Answer:


This is the 1M$ question :-) In trunk there is some speedup of loading files, something we are constantly trying to look at. Multi treading of packet dissection is not easy as the dissection of a packets may depend on dissection of a previous packet like reassembly or state or... It has been discussed but no one has come up with a solution yet.

answered 28 Sep '12, 08:42

Anders's gravatar image

Anders ♦
accept rate: 17%