Re: how to handle big files in wireshark

["Bryan Hoyt | Brush Technology" <bryan () brush co nz>]

Yeah, those are big files. I work with files of 100's of megabytes, so I
know how slow it can be. But I can imagine 7 Gb files would be a
show-stopper.

What sort of analysis are you wanting to do? Is it possible that a
roll-your-own solution using libpcap to iterate through the file would do
the trick? Or do you really need the interactive UI goodness of Wireshark?

 - Bryan

-- 
PS. Check out the Brush newsletter: *Subscribe or read our previous
newsletters* <http://brush.co.nz/articles>

Bryan Hoyt, *Web Development Manager*  --  Brush Technology
*Ph:* +64 3 942 7833     *Mobile:* +64 21 238 7955
*Web:* brush.co.nz
On Sat, Jul 10, 2010 at 11:40, Maverick <myeaddress () gmail com> wrote:

> Bryan you are write that way I can improve the performance a little bit but
> in my case pcap files are 6 or 7 Gbs so its not making much of a difference
> by disabling those features.
>
> MK
>
>
> On Fri, Jul 9, 2010 at 7:36 PM, Bryan Hoyt | Brush Technology <
> bryan () brush co nz> wrote:
>
> > I'm not an expert here, but isn't it possible to reduce the amount of
> > memory used by disabling all the protocols that you don't use (or even the
> > ones you do use, if you can live without them)?
> >
> > I think a lot of the memory usage comes from the specific protocols, not
> > just the wireshark core.
> >
> > Correct me if I'm wrong.
> >
> >  - Bryan
> >
> > On Sat, Jul 10, 2010 at 08:10, Maverick <myeaddress () gmail com> wrote:
> >
> > > Thanks for the response , If I break files down into many pcap files is
> > > there any way that I can have access to all those broken files. Like if I
> > > select follow stream option would it be possible to get streams that are in
> > > the other broken files.
> > >
> > > Thanks
> > > MK
> > >
> > >
> > > On Fri, Jul 9, 2010 at 3:57 PM, Guy Harris <guy () alum mit edu> wrote:
> > >
> > > > On Jul 9, 2010, at 12:46 PM, Maverick wrote:
> > > >
> > > > > I have huge pcap files in Gbs which I want to analyze using wireshark
> > > > but wireshark is extremely slow and crashes while opening those files. I
> > > > tried breaking those files into smaller files but thats not very good
> > > > solution as I have to open up each file and sometime relationship between
> > > > files gets lost.
> > > > > Is there a decent way to handle huge files in wireshark .
> > > >
> > > > For now, the only way is "use a 64-bit version of Wireshark, make sure
> > > > you have enough disk space/swap space to back up a large virtual address
> > > > space, and live with the slowness".
> > > >
> > > > There may be changes in the future to reduce the memory requirements,
> > > > but they're not trivial to make.
> > > >
> > > > ___________________________________________________________________________
> > > > Sent via:    Wireshark-users mailing list <
> > > > wireshark-users () wireshark org>
> > > > Archives:    http://www.wireshark.org/lists/wireshark-users
> > > > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> > > >             mailto:wireshark-users-request () wireshark org
> > > > ?subject=unsubscribe
> > >
> > >
> > >
> > > ___________________________________________________________________________
> > > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org
> > > >
> > > Archives:    http://www.wireshark.org/lists/wireshark-users
> > > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> > >             mailto:wireshark-users-request () wireshark org
> > > ?subject=unsubscribe
> >
> >
> >
> > ___________________________________________________________________________
> > Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >             mailto:wireshark-users-request () wireshark org
> > ?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe