This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to open large pcap files faster?

0

I'm trying to open fairly large pcap files (about 500MB) and they're loading extremely slow. I imagine the reason for this is due to the sheer number of packets. While loading, I noticed that only a single core on my processor is being used (maxed out to 99% utilization). I believe this is my bottleneck since I have plenty of memory.

Is there a way to utilize multiple cores when opening pcap files? Can anyone recommend other methods of speeding up the process?

Thanks, Keith

asked 28 Sep '12, 07:44

kfryklund's gravatar image

kfryklund
1334
accept rate: 0%


One Answer:

0

This is the 1M$ question :-) In trunk there is some speedup of loading files, something we are constantly trying to look at. Multi treading of packet dissection is not easy as the dissection of a packets may depend on dissection of a previous packet like reassembly or state or... It has been discussed but no one has come up with a solution yet.

answered 28 Sep '12, 08:42

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%