Hi, I have a requirement to monitor a 1GBps data stream and would like to further understand Wireshark's monitoring capabilities. Is the GUI display responsive to continuous capture at 1GBps i.e can you still scroll/read the display during continuous high speed data capture? Is there a limit to the amount of data Wireshark can comfortably handle? Thanks Andy asked 07 Nov '14, 07:50  awl |
One Answer:
No, Wireshark can't handle 1GBps unless you capture it with specialized hardware, e.g. Napatech or Fiberblaze cards (at least Napatech does not sell to retail though). Normal NICs will fail to capture consistently at about 200-300 MBit at the most. And forget scrolling - it's not going to work well at anything above a couple of MBit because it is not going to show much except for a slide show (if it moves at all). It also leads to dropped frames because it puts additional stress on the capture machine. answered 07 Nov '14, 11:59  Jasper ♦♦ |
Can you read the data on the screen if it's coming in at 1GBps?
Wireshark (and tshark) will run out of memory at some point because of all the conversation tracking they do. The faster it comes in, the faster it will happen. If you want to capture in such situations for post-analysis then use dumpcap.
I'd can only imagine that if Wireshark had a virtual display it could display just enough capture data on screen according to the user positioning the slider, but it appears it does not.
Do you know what data capture size Wireshark can support? I vaguely recall reading Wireshark handling 100MB of data but struggles beyond that amount.
The supported capture size is very hard to answer, it depends on the data in the capture and how much extra memory is consumed for conversations, synthesised data etc.
I've opened files of 2GB before, but they're not fun to work with as any filter op takes a long time.
The memory problem is normally circumvented by using dumpcap to capture to multiple files. @Jasper has blog entry about it here.