|
I am having difficulty opening a series of files created by tshark.exe. It is rather large, but I have opened large files before without a problem. The loading is even done in a separate thread so I can see the progress of it in the GUI. This is the info from capsinfos.exe about the file in question: File type: Wireshark - pcapng File encapsulation: Ethernet Packet size limit: file hdr: (not set) Number of packets: 907544 File size: 146040212 bytes Data size: 115427911 bytes Capture duration: 86397 seconds Start time: Sat Aug 04 22:07:38 2012 End time: Sun Aug 05 22:07:35 2012 Data byte rate: 1336.02 bytes/sec Data bit rate: 10688.14 bits/sec Average packet size: 127.19 bytes Average packet rate: 10.50 packets/sec SHA1: 074c2dbbfa65835f8cb6deb595ee6face9159ed9 RIPEMD160: d7f963a411ae8d37c83b07fe660a11163a11bc57 MD5: 612aac26fa3c140bd182ad44ae8836bd Strict time order: FalseThis is one example in a series of files I am generating on a 24 hour rotation. Any suggestions how I might get these files opened? |
|
Wireshark collects (possibly an awful) lot of state while loading a capture. It's impossible to tell how much beforehand. That could lead to problems. Another option is that you've hit upon a dissection bug. Anyway, to work around these use editcap to slice your capture in two and try to load each separately. This may show which part contains the cause. Maybe repeat the slicing even further. You can also load a file set if you need packets from multiple slices. Experiment a bit and see what it tells you. |
146 MByte is not really a large capture file for a "decent" system. If your system has >= 2 GByte RAM, you "should" be able to open that file, expect you are running into a bug. Somme suggestions:
Regards Kurt I have 16Gb of RAM on both systems that I used to try opening the file. I have opened other, larger files without any problems. I did use editcap.exe to split the file into 100,000 packet files which makes them 13-15Mb and had the exact same problem. If I try and open a log file from a previous week, which was generated on the same system with (I think) the exact same tshark.exe syntax, it works fine!
(07 Aug '12, 05:52)
namreeb
Some more questions:
(07 Aug '12, 06:21)
Kurt Knochner
(07 Aug '12, 12:52)
namreeb
sounds like a bug. By any chance: Is there HSRP traffic in the capture file (Bug 7581)? Some more questions:
(07 Aug '12, 17:18)
Kurt Knochner
No, it should be strictly MySQL traffic in the capture. But it is on port 3307 rather than 3306 and at the time of loading I have not yet told it to analyze the traffic as MySQL. No, the files are not being loaded from a share. I downloaded Wireshark 1.6.9 and was unable to load it due to a missing "libxml2-2.dll". I downloaded 1.4.14 (rev 43964) and it loads! Should I report this on the bug tracker? I can provide my traffic dump if it will be limited to the developer(s).
(07 Aug '12, 19:40)
namreeb
O.K. this sounds like a bug.
yes please.
You can mark the file as private during upload.
Does it fail to load any (mysql) capture file, or just your mysqsl traffic on port 3307? Can you please try this short mysql sample?
(08 Aug '12, 01:28)
Kurt Knochner
showing 5 of 6
show 1 more comments
|
