Ask Your Question

How to reduce the load while analysing big file?

asked 2021-06-20 19:09:00 +0000

neverxxsleep gravatar image

Hello. I have 10 files of my packets captured. 1 file contains at least 2+ billion packets which cause big load for my system when I try to analyse file with endpoints, dialogues, etc. It can take up to 5-10 minutes to load it and then still lagging so much when I'm clicking "resolve names".

I think my pc not so bad, because it worked okay when I was analysing dump files with +-800k packets. So, are there any methods, maybe, how to divide analysis of 2 billion packets for 4 parts, for example?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-06-20 19:55:00 +0000

grahamb gravatar image

The Wireshark suite includes editcap that can be used to split a capture file into multiple parts.

There are options to split with a limit of the number of packets per file, -c or by interval (seconds per capture, -i.

There are also options to cut the length of each packet, -s, for example if you don't need traffic above the TCP layer.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-06-20 19:09:00 +0000

Seen: 116 times

Last updated: Jun 20 '21