Ask Your Question
0

M2 Max MacBook Pro 96G RAM vs Win11 Dell Inspiron i7 16G RAM

asked 2024-02-16 14:23:29 +0000

I compared performance of WireShark, latest version, on a very powerful Mac to a reasonable Dell Windows 11 computer.

I obtained a 2.3GB .pcapng file for analysis. It was provided by a client experiencing a packet storm. Here are the results of loading the file, running the Expert Analysis, and obtaining the IPv4 Endpoint table:

  • MacBook Pro, 96G, M2Max: 11 hours 45 minutes
  • Dell Inspiron: 31 seconds

Due to the ridiculous difference in performance, I wiped Wireshark from the powerful Mac and reinstalled from scratch. Opened the .pcapng file again and ran the same tests. Results were basically the same. (Yes, this took two days to finish)

Any idea what is wrong with the Arm64 code for Wireshark? I"ve benchmarked this Mac against the Dell laptop in every other application and it has always been faster, sometimes 2-4x faster. Wireshark on the Mac appears to be 1,364 times SLOWER.

Watching this pathetic load and analysis operation it looks like the Mac version of the code loads a few packets recalculates everything, then loads a few more packets. This is based on the spinning beachball of death which appears, then the statistics screen updates with perhaps a hundred more packets analyzed, then repeats indefinitely.

On the other hand, in WIndows, it appears Wireshark loads everything, runs a single analysis, and finishes promptly.

Not sure if that observation matches what is happening, as I would assume the source code base is the same and Wireshark merely compiles to different target architectures.

Any Wireshark-on-Mac experts out there who can shed light on this massive performance difference?

edit retag flag offensive close merge delete

Comments

Both machines were running the same version number of Wireshark and used the same configuration profile?

Chuckc gravatar imageChuckc ( 2024-02-16 14:25:20 +0000 )edit

Yes, identical installations except for the target architecture installation files were different, of course. Both were 100% default clean installations. Wiped the installs and repeated on the Mac, again accepting the defaults.

ZephyrC gravatar imageZephyrC ( 2024-02-16 14:32:37 +0000 )edit

Clean installs, but also the same _configuration_? These are not part of the install, but personal data.

Jaap gravatar imageJaap ( 2024-02-16 19:10:12 +0000 )edit

I ran a file by file comparison of the contents of APPDIR/Contents/Resources/share/wireshark/* against the same contents in the PC at C:/Windows/Program Files/wireshark. Windows has some DLL's and executables present that Mac does not. HTML configuration files and diameter, dtds, profiles, protobuf, radius tpncp, and wimaxasncp folders all have the same contents. Windows Wireshark has a plugins folder that Mac does not.

ZephyrC gravatar imageZephyrC ( 2024-02-16 22:13:27 +0000 )edit

Windows has some DLL's and executables present that Mac does not.

The macOS app bundle for Wireshark stores executables in APPDIR/Contents/MacOS, and stores shared libraries (the UN*X equivalent of DLLs) in APPDIR/Contents/Frameworks/, not anywhere under APPDIR/Contents/Resources/share/wireshark/.

HTML configuration files and diameter, dtds, profiles, protobuf, radius tpncp, and wimaxasncp folders all have the same contents.

Those are the application-provided configuration files. There are also user configuration files, stored in $HOME/.config/wireshark in UN*Xes such as macOS and in %APPDATA%\Wireshark (or %USERPROFILE%\Application Data\Wireshark if %APPDATA% isn't defined).

Windows Wireshark has a plugins folder that Mac does not.

The macOS app bundle for Wireshark stores Wireshark plugins in directories under APPDIR/Contents/PlugIns/wireshark.

Guy Harris gravatar imageGuy Harris ( 2024-02-17 07:04:45 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2024-02-17 07:30:02 +0000

Guy Harris gravatar image

On macOS, Activity Montior can get a sample of what a program is doing - select the program in Activity Montior and, from one of the drop-down menus from the toolbar, select "Sample Process".

Please try that when Wireshark is slowly loading the file, save the sample to a file (using the "Save..." button in the window containing the sample), and then file an issue on the Wireshark issue list about this, and attach the file containing the sample to the issue.

edit flag offensive delete link more

Comments

Will do. CPU was between 99.7 and 100% whenever I looked. I obviously didn't hang around for 11 straight hours to watch it.

Repeated the test (again, #3) after rebooting both laptops:

  • Dell: 32 seconds to load
  • M3Max MacBook Pro: 10 hours 57 minutes to load

.pcapng file is 2.3GB, a direct port monitor capture from a Cisco 3850 switchport.

ZephyrC gravatar imageZephyrC ( 2024-02-17 13:32:49 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2024-02-16 14:23:29 +0000

Seen: 267 times

Last updated: Feb 17