Ask Your Question
0

Conversations view much slower in 4.0.x than older version on Mac

asked 2023-02-01 19:28:44 +0000

Fred gravatar image

I look at large number of short lived conversations in Wireshark. The conversations view makes is how I look for failed or long running connections that exceed SLA. 4.0.x is much slower to populate the conversation view than previous versions on the Mac OS. My environment is spine leaf so VXLAN headers also add the UPD conversations making the issues worse. I have all name lookups and color rules disabled to speed up opening traces.

Any suggestions on how to speed up conversation view

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-02-02 01:11:02 +0000

Chuckc gravatar image
edit flag offensive delete link more

Comments

I did some more research. Installed 3.6.11. It also opens large captures about 10x faster. I am guessing the same parser is used to read the file both times. Really like the 4.x improvements but I work with large captures and need the speed of older version.

Fred gravatar imageFred ( 2023-02-02 22:56:05 +0000 )edit

I added your comment to the gitlab issue. It would be good to follow along over there for any progress.

Chuckc gravatar imageChuckc ( 2023-02-02 23:30:12 +0000 )edit

I did some more research. Installed 3.6.11. It also opens large captures about 10x faster

So that's just the time from opening the file to having the read-in finish being 10x greater in 4.x, without doing anything after the file is fully read in?

Guy Harris gravatar imageGuy Harris ( 2023-02-05 19:43:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2023-02-01 19:28:44 +0000

Seen: 102 times

Last updated: Feb 02 '23