This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

I am using tshark to sniff HTTP content on a very busy server and I see that the CPU usage of the tshark process is very high.

This is the command line I am using:

tshark.exe -i3 -l -f "tcp port 80" -O http -d tcp.port==80,http -o "ip.use_geoip:FALSE" -R "not tcp.analysis.duplicate_ack" -T fields -e ip.host -e tcp.port -e http.request.full_uri -e http.request.method -e http.response.code -e http.response.phrase -e http.content_length -e data -e text -E separator=;2>&0

Is there anything I can do to get the same result - but with better performance? Can anyone point to any part of the command line that might be the reason for the high CPU usage?

Thanks

David

asked 04 Mar '13, 11:34

David%20Sackstein's gravatar image

David Sackstein
31448
accept rate: 0%


Wow, this is some tshark command line. I assume you need the -l because you pipe the output to another tool or script? I think you can leave out the -O http bit, since you later on as for specific fields using -T. I also think you can leave out the -d tcp.port==80,http bit, it's rather obvious tcp port 80 traffic is HTTP, at least that's what the HTTP dissector assumes. I'm not sure these would improve performance though. I recon taking out the -R filter would.

permanent link

answered 04 Mar '13, 15:00

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Is there anything I can do to get the same result - but with better performance?

please try this:

tshark.exe -n -i3

instead of

tshark.exe -i3

Regards
Kurt

permanent link

answered 05 Mar '13, 12:26

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hi Kurt, Thanks for this tip. Is the order of the options actually important too? Must -n be before -i3? Thanks David

(05 Mar '13, 12:41) David Sackstein

The order does not matter.

(05 Mar '13, 12:48) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×55

question asked: 04 Mar '13, 11:34

question was seen: 3,204 times

last updated: 05 Mar '13, 12:48

p​o​w​e​r​e​d by O​S​Q​A