When I open a .pcap on wireshark1.8.5. Is take very long time. about 15 minute, size of the .pcap is 90 MB. why it took so long time? In the *.pcap, there are many rlc rrc message.is the rlc reassembly step take too much time ? Thanks! asked 17 Feb '13, 19:52  smilezuzu |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Possibly, if you could raise a bug report including the trace file that might help to find out if anything can be done to speed it up or you could run a profiler tool.
the *.pcap file is too big to upload. and there is no bug report, just took too much time to decode.
Still, if you open a bug at https://bugs.wireshark.org/bugzilla/ I think you can add the file therwe.
could you help me? Another question: 1,How did the rlc reassemble the code from mac in wireshark? you should tell me the main step of reassemble in wireshark.
2,Is the wireshark malloc memory for each rlc SDU? because when the wireshark decode a big *.pcap,it will occupy a big memory.
Thanks!
added, if the wireshark reassemble the code from mac like this step: 1,decode each rlc code and malloc new memory for each rlc SDU. 2,when user click the frame .wireshark will find the rlc SDU's which have the same logical channel id. and then reassemble those ,transport to up level. 3,so for each rlc decode,it need to search the memory which malloced by rlc. if the memory is big, then the time used to decode is long.