 | 1 | initial version |
Yes, use the GTK version of Wireshark. It allows you to interrupt the loading of large captures, a features that wasn't ported to the Qt interface AFAIK. But it won't help with other operations (filtering, etc. IIRC), which reloads the capture file, so is of limited use.
Another option is to use editcap to split the capture files into more manageable parts.
