This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When I try and load a small capture (<5MB) Wireshark take over 2.5GB of ram and it takes a long time for the capture to appear on the screen. When my coworker loadss the same file on his machine running the same version of Wireshark it comes right up and utilizes little memory. Any ideas? Thanks for the assist!

asked 19 Jul '16, 11:35

kdonovan9's gravatar image

kdonovan9
6112
accept rate: 0%

edited 20 Jul '16, 08:05

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

Did you try with identical Wireshark Versions and identical profiles? Profile settings can affect how Wireshark behaves, so even the same version may show differences.

Easiest way to test is to create a new (=default) profile on both machines, and load the trace again.

(19 Jul '16, 11:45) Jasper ♦♦

I'd suggest comparing your preferences files. I wouldn't be surprised if you had something like TCP reassembly enabled while your colleague had it disabled. You can find your preferences file via Help -> About Wireshark -> Folders -> Personal configuration.

You could also look for any other differences between the machines, such as OS, 64-bit vs. 32-bit, etc. Compare Help -> About Wireshark information.

permanent link

answered 19 Jul '16, 11:47

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Another possibility we saw recently is that your ssl_keylog file has grown to a huge size. See bug 12501 for the history.

permanent link

answered 20 Jul '16, 06:19

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

I have this same problem. I downgraded to 2.2.8 and removed my personal settings as well. My sslkeylog is 70M. I will have to see what I did to enable the use of that file and see if my slowness comes back.

(26 Jul '17, 10:47) garrywx

Ok that was it for sure. Recreated my problem after changing the setting under Pref->Protocols->SSL (Pre)-Master-Secret Log filename to point at my 70M file. I then deleted the file and performance is back to normal.

(26 Jul '17, 11:04) garrywx
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×23
×10
×1

question asked: 19 Jul '16, 11:35

question was seen: 1,538 times

last updated: 26 Jul '17, 11:04

p​o​w​e​r​e​d by O​S​Q​A