This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

This is a copy from the bug I filled in Bug Database to start a discussion between developers and community https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13694

Today most professional capture files can't be opened directly in Wireshark due to their size and in front of a 10GB pcap file, the open source user has:

  • sequential packet readers (tcpdump/dumpcap) + capture filters
  • custom index tools

At the opposite, network softwares are building indexes that are pretty efficient (Riverbed Packet Analyzer index and micro-index, Extrahop, etc ...)

Several open source projects exist, but afaik none are really linked/approved by Wireshark community yet:

Discussion is wide and not straightforward: indexing will be a trade off between size of index / speed / evolutivity. The idea is to throw ideas / experience / suggestions and find some bases for some specifications/code integration/development to start and maybe integrate Wireshark one day. (File -> Index PCAP !)

asked 10 May '17, 05:34

TomLaBaude's gravatar image

TomLaBaude
66171724
accept rate: 66%

The place for such discussions is on the Wireshark Dev list mailist, this isn't a question that can be answered here.

Please start such a discussion, then a link for the mail archives can be posted back here for reference.

(10 May '17, 05:41) grahamb ♦

Thanks Graham, will do. I also wanted to have feedback from non Wireshark dev who may have used PCAP indexing or the previous products and have suggestions

(10 May '17, 05:47) TomLaBaude
1

I agree that soliciting input from all sources is helpful for the discussion, so a cross posting to the User Mailing list noting the Dev thread might help, but again, Ask really doesn't work well, or is designed for, discussions so as soon as the dev thread is started, I'll amend this question with the reference and close it out.

(10 May '17, 05:58) grahamb ♦

Just sent email to Wireshark-dev, awaits moderator approval as post by non-member to a members-only list

(10 May '17, 06:00) TomLaBaude
1

Did you subscribe to the list already? Otherwise you won't see on-list answers.

(10 May '17, 06:47) Jaap ♦
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×5
×5

question asked: 10 May '17, 05:34

question was seen: 1,033 times

last updated: 10 May '17, 06:47

p​o​w​e​r​e​d by O​S​Q​A