 | 1 | initial version |
In general tshark/wireshark will consume more and more memory as more packets is read in. The only workaround is to split the file in managble chunks. Editcap is one tool that can be used. That said I haven't had problems handling files > 500 MB(other than the time it taks to filter them) so possibly there is someting sub optimal in your code.
| | 2 | No.2 Revision |
In general tshark/wireshark tshark/wireshark will consume more and more memory as more packets is are read in. The only workaround is to split the file in managble manageable chunks. Editcap Editcap is one tool that can be used. used for this purpose. That said said, I haven't had problems handling files > 500 MB(other MB (other than the time it taks takes to filter them) them), so possibly there is someting sub optimal something sub-optimal in your code. code.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
