wireshark takes long time to load pcap

asked 2020-05-27 02:44:59 +0000

hoangsonk49 gravatar image

updated 2020-05-27 05:42:15 +0000

Hi everyone, I'm using wireshark to view pcap file and tshark to read pcap also. As can be seen, the file length is about 20 MB and captured time: 9 seconds, but wireshark takes about 27 seconds to display all packets. I tried with some captured file from other interfaces with the same size , and it took just few seconds to load. I don't know why, please help if you have any expericence on this case and guide me that how to save time to load (or to read file by tshark). Thank you very much!

I cannot attach the pcap file so I put it on google drive : https://drive.google.com/file/d/1z2Tm...

image description image description

edit retag flag offensive close merge delete

Comments

What is the display filter set to?
Is name resolution enabled?

Chuckc gravatar imageChuckc ( 2020-05-27 03:11:36 +0000 )edit

Hi, I don't set any filter, just open the pcap file captured by tcpdump

hoangsonk49 gravatar imagehoangsonk49 ( 2020-05-27 05:43:24 +0000 )edit

I tried with some captured file from other interfaces with the same size , and it took just few seconds to load.

Do the other files that loaded faster each have approximately the same number of packets as the file that took 27 seconds to load? Or do they have fewer packets, even though they're approximately 20 MB in size as well?

Guy Harris gravatar imageGuy Harris ( 2020-05-27 08:52:42 +0000 )edit

Hi Harris, the number of packet in the other file is greater. Here are some properties of that file compare to the slower loading file:

  • File Length: 66 MB (compared to 20M)

  • Time Elapsed: 6 seconds (compared to 9 seconds)

  • Packets: 255999 (compared to 155101)

  • Average pps: 37109.1 (compared to 16669.3)

  • Average bits/s: 67 M (compared to 15 M)

  • Loaded Time: 7 seconds (compared to 34 seconds)

hoangsonk49 gravatar imagehoangsonk49 ( 2020-05-27 09:16:40 +0000 )edit

It's likely the file that's slower to load capture has traffic that has more dissection "work" in it. This possibly includes the protocols, extra fields, decompression and decryption.

File size is no indication of the complexity of the traffic.

Maybe compare the Protocol Hierarchy in the two files to see what's different.

grahamb gravatar imagegrahamb ( 2020-05-27 10:04:28 +0000 )edit
add a comment