This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I have a requirement to monitor a 1GBps data stream and would like to further understand Wireshark's monitoring capabilities.

Is the GUI display responsive to continuous capture at 1GBps i.e can you still scroll/read the display during continuous high speed data capture?

Is there a limit to the amount of data Wireshark can comfortably handle?

Thanks Andy

asked 07 Nov '14, 07:50

awl's gravatar image

awl
11223
accept rate: 0%

Can you read the data on the screen if it's coming in at 1GBps?

Wireshark (and tshark) will run out of memory at some point because of all the conversation tracking they do. The faster it comes in, the faster it will happen. If you want to capture in such situations for post-analysis then use dumpcap.

(07 Nov '14, 09:17) grahamb ♦

I'd can only imagine that if Wireshark had a virtual display it could display just enough capture data on screen according to the user positioning the slider, but it appears it does not.

Do you know what data capture size Wireshark can support? I vaguely recall reading Wireshark handling 100MB of data but struggles beyond that amount.

(11 Nov '14, 07:38) awl

The supported capture size is very hard to answer, it depends on the data in the capture and how much extra memory is consumed for conversations, synthesised data etc.

I've opened files of 2GB before, but they're not fun to work with as any filter op takes a long time.

The memory problem is normally circumvented by using dumpcap to capture to multiple files. @Jasper has blog entry about it here.

(11 Nov '14, 08:04) grahamb ♦

No, Wireshark can't handle 1GBps unless you capture it with specialized hardware, e.g. Napatech or Fiberblaze cards (at least Napatech does not sell to retail though). Normal NICs will fail to capture consistently at about 200-300 MBit at the most.

And forget scrolling - it's not going to work well at anything above a couple of MBit because it is not going to show much except for a slide show (if it moves at all). It also leads to dropped frames because it puts additional stress on the capture machine.

permanent link

answered 07 Nov '14, 11:59

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×22
×8
×1

question asked: 07 Nov '14, 07:50

question was seen: 1,941 times

last updated: 11 Nov '14, 08:04

p​o​w​e​r​e​d by O​S​Q​A