0

Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?

I have a big pcap file and wireshark is crashing when I try to open it.

I know it sums and computes a lot of information.

Is there another alternative to solve this problem?

Thanks in advance.

3
  • 1
    You've tried 64-bit Wireshark, haven't you? Have you tried tcpdump/WinDump?
    – Zac67
    Mar 16 at 18:33
  • 2
    Check if you are running out of RAM or if you have an error log from your operating system indicating insufficient RAM or an application limit. You can also use tcpdump on Linux to segment the file into smaller pieces. tcpdump -r old_file -w new_files -C 10 Mar 16 at 20:27
  • Wireshark loads the entire capture into memory. That's always going to be a slow process for a large capture.
    – Ricky
    Mar 17 at 3:00

1 Answer 1

1

I found some solutions to my problems. But before that, thank you all for the comments.

I found pcapinfo to print a summary of the pcap file. It had the information that I needed (throughput).

But my problem was that I was storing the content of the TCP packet. By using -s <snaplen>, --snapshot-length <snaplen> in tshark I was able to capture the packets in a reasonable size pcap file and open it in Wireshark.

I was not so used to tshark and I did not know this option (I was looking for it but I did not find it before I had this problem).

Anyways, thanks.

New contributor
Bruno Lebtag is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
2
  • 1
    Well, it always depends on what you're actually looking for and what needs to be captured. In your question you didn't ask for "headers only, no data"... ;-)
    – Zac67
    Mar 20 at 17:50
  • Sorry about that. 2 days ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.