Why is tshark slow to start up, even if you're only running it with -h or -v?

asked 2019-02-19 16:26:48 +0000

updated 2019-02-19 21:48:46 +0000

cmaynard gravatar image

When executing a tshark -h or tshark -v it takes +/- 100 seconds before I get a response on Windows 10 - 1089. There is no resource issue in Windows Task Manager.

C:\Users\PatrickCoulier>tshark -v
TShark (Wireshark) 2.6.6 (v2.6.6-0-gdf942cd8)

Copyright 1998-2019 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http: www.gnu.org="" licenses="" old-licenses="" gpl-2.0.html="">
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with WinPcap (4_1_3), with GLib 2.42.0, with zlib 1.2.11, with
SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.4.11, with Gcrypt
1.7.6, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.14.0, with
LZ4, with Snappy, with libxml2 2.9.4.

Running on 64-bit Windows 10, build 17763, with Intel(R) Core(TM) i5-6200U CPU @
2.30GHz (with SSE4.2), with 8088 MB of physical memory, with locale
English_United States.1252, with WinPcap version 4.1.3 (packet.dll version
4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with
GnuTLS 3.4.11, with Gcrypt 1.7.6, binary plugins supported (13 loaded).

Built using Microsoft Visual Studio 2017 (VC++ 14.12, build 25835).

What is going wrong here?

Patrick

edit retag flag offensive close merge delete

Comments

Just a guess, but did you install any extcaps like sshdump or ciscodump? How about USBPcap? You could try reinstalling Wireshark without those components to see if the delay disappears.

You might also want to uninstall WinPcap and install npcap instead. Most likely this isn't the cause of your immediate problem, but Wireshark is recommending npcap now and WinPcap will no longer be shipped with Wireshark once 3.0 is released, so it's not a bad idea to make the switch.

cmaynard gravatar imagecmaynard ( 2019-02-19 17:08:36 +0000 )edit

If you go with the development version startup speed has been greatly improved and loading of extcap or not is a preference. Checking of capture interfaces at startup is also a preference.

Anders gravatar imageAnders ( 2019-02-19 22:00:00 +0000 )edit