Ask Your Question
0

Is it possible to load a pcap file and view packets without loading the whole file?

asked 2017-12-12 02:52:13 +0000

James_Adriano gravatar image

Some pcap files are taking too long to load. Is there a way I can tweak the code to have a behavior similar to packets from live captures?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
1

answered 2017-12-12 06:41:52 +0000

Guy Harris gravatar image

The code that handles packets from live captures is the same code that handles packets from capture files. During a live capture, dumpcap writes packets to a file that Wireshark or TShark has open, and, if it's written a batch of N packets to the file, sends Wireshark/TShark a message saying "I've just added N more packets", and Wireshark/TShark reads the next N packets from the file when it reads that message.

So presumably what you mean is "is there any way to have the packets show up as they're loaded if I'm reading a capture file, rather than waiting for the entire file to be read in before seeing any packets?"

It might be possible to change Wireshark's file-reading code to do that (I've seen Microsoft Word show similar behavior when reading a large document - the scrollbar changes as the file is being read, indicating that more text is available), although it's probably more than just a tweak, and it'd be best to make sure it doesn't slow down the process of reading the entire file too much.

edit flag offensive delete link more

Comments

Thank you Guy Harris for the feedback. It's clear now that packet handling is the same for live capture and capture files.

So presumably what you mean is "is there any way to have the packets show up as they're loaded if I'm reading a capture file, rather than waiting for the entire file to be read in before seeing any packets?" - Yes, this is a better way to put it.

It's nice to hear that its possible.

I agree that it best be sure to see if it might slow down with packet list pane updates. I can imagine viewing a capture file similarly with how a live capture populates the packet list pane.

Maybe this could be an optional read mode to pursue for users with large files.

James_Adriano gravatar imageJames_Adriano ( 2017-12-12 07:34:56 +0000 )edit
0

answered 2017-12-12 06:41:13 +0000

Jaap gravatar image

Yes, use the GTK version of Wireshark. It allows you to interrupt the loading of large captures, a features that wasn't ported to the Qt interface AFAIK. But it won't help with other operations (filtering, etc. IIRC), which reloads the capture file, so is of limited use.

Another option is to use editcap to split the capture files into more manageable parts.

edit flag offensive delete link more

Comments

It allows you to interrupt the loading of large captures, a features that wasn't ported to the Qt interface AFAIK.

No, when the file is being read in, there's a progress bar in the status area at the bottom of the Wireshark window, with an [X] box next to it (it turns red when you hover over it) - click on the [X] and the read stops.

Guy Harris gravatar imageGuy Harris ( 2017-12-12 06:44:58 +0000 )edit

Thank you Jaap for the feedback. I've tried clicking on the [X] and the reading did stop. Thanks for the suggestion of editcap.

James_Adriano gravatar imageJames_Adriano ( 2017-12-12 07:34:57 +0000 )edit

@Guy Harris Aha, so that's where it ended up. A more subtle UI element instead of a dialog.

Jaap gravatar imageJaap ( 2017-12-12 09:55:45 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

2 followers

Stats

Asked: 2017-12-12 02:52:13 +0000

Seen: 157 times

Last updated: Dec 12 '17