How to handle a big trace file?

Question

Hi experts,

I know that open a big trace file by wireshark will be slower than opening a relatively small trace file. How would you deal with it generally? Is there any better way to do this?

thanks a lot!

Accepted Answer

0

There are two ways

get a real fast system (CPU) with lots of RAM (several Gig) and with a 64 bit OS
split the capture file with editcap

Regards
Kurt

answered 23 Jan '14, 07:51

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

thank you, Kurt. [to myself notes: editcap is an application located in the wireshark installation direcotry, just as tshark.]

(25 Jan '14, 07:05) SteveZhou

By the way, is there any options for tshark which can read just part of the trace file so that we don't need to load the entire trace, it will also reduce time for loading data.

(25 Jan '14, 07:07) SteveZhou

Hm, do you mean something like this?

-Y "frame.time_relative > 30 and frame.time_relative < 40"

-Y " frame.numbger gt 45000 and frame.number le 55000"

(25 Jan '14, 22:19) mrEEde

Hi mrEEde,

sorry, I have no experience with tshark before so I'm trying to understand what you typed. I found the following two options for tshark:

-R <read filter=""> packet Read filter in Wireshark display filter syntax -Y <display filter=""> packet displaY filter in Wireshark display filter syntax

My goal is to read just part of a big trace file just like you mentioned above. But would tshark actually read the entire big trace file into memory and then apply display filter by running the -R or -Y option? If that is the case, tshark still needs to read the entire big file and consume lot of time.

(27 Jan '14, 17:55) SteveZhou

Answer 2

"sorry, I have no experience with tshark before so I'm trying to understand what you typed. I found the following two options for tshark:
-R <read filter=""> packet Read filter in Wireshark display filter syntax -Y <display filter=""> packet displaY filter in Wireshark display filter syntax"

tshark -Y reads a trace record and applies a filter to it. If the filter condition is true, the packet will be processed (displayed or with -w written to a new file.)
The trace file will not be read completely but on a packet by packet basis.

tshark -r t1_400k.pcap -R "frame.number gt 10000 and frame.number le 11000" -w just1k.pcapng
tshark: -R without -2 is deprecated. For single-pass filtering use -Y
tshark -r t1_400k.pcap -Y "frame.number gt 10000 and frame.number le 11000" -w just1k.pcapng