2

Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?

I have a big pcap file and wireshark is crashing when I try to open it.

I know it sums and computes a lot of information.

Is there another alternative to solve this problem?

Thanks in advance.

Improve this question
3
  • 1
    You've tried 64-bit Wireshark, haven't you? Have you tried tcpdump/WinDump?
    – Zac67 ♦
    Mar 16 at 18:33
  • 2
    Check if you are running out of RAM or if you have an error log from your operating system indicating insufficient RAM or an application limit. You can also use tcpdump on Linux to segment the file into smaller pieces. tcpdump -r old_file -w new_files -C 10
    – FrameHowitzer
    Mar 16 at 20:27
  • Wireshark loads the entire capture into memory. That's always going to be a slow process for a large capture.
    – Ricky
    Mar 17 at 3:00

1 Answer 1

Reset to default
2

I found some solutions to my problems. But before that, thank you all for the comments.

I found pcapinfo to print a summary of the pcap file. It had the information that I needed (throughput).

But my problem was that I was storing the content of the TCP packet. By using -s <snaplen>, --snapshot-length <snaplen> in tshark I was able to capture the packets in a reasonable size pcap file and open it in Wireshark.

I was not so used to tshark and I did not know this option (I was looking for it but I did not find it before I had this problem).

Anyways, thanks.

Improve this answer
2
  • 1
    Well, it always depends on what you're actually looking for and what needs to be captured. In your question you didn't ask for "headers only, no data"... ;-)
    – Zac67 ♦
    Mar 20 at 17:50
  • Sorry about that.
    – Bruno Lebtag
    Mar 21 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.