Hi, I have a simple doubt in Wireshark, in opening a saved capture file. here what I observed is, when we open the capture file (file->open), it will open the selected file. if the file is large then it will show a window to show some statistical information as the image shows, here my doubt is 1) How do we know the number of frames in the saved capture file? 2) It is showing Elapsed time and Time Left, how it is achieving? asked 07 Apr '15, 05:59  sathish308 |
One Answer:
Your screenshot is not a loading dialog, it's a frame processing dialog (e.g. when you apply a filter). After loading a capture file Wireshark knows how many packets are in the file, so that's easy. If you're loading a file Wireshark usually scans the file when you click on it in the file dialog and tries to determine some file details. If the file is too big it will abort that scan at some point. Elapsed time and time left are most likely calculated based on the current read speed and the amount of remaining bytes Wireshark has to load. answered 07 Apr '15, 06:15  Jasper ♦♦ |
Yes - "elapsed time" is just derived from the date-and-time-of-day clock values provided by the operating system, and "time left" is derived based on an assumption that the rate at which frames have been and will be read is constant, so if you've read 50 out of 100 frames, and it took 10 seconds, the remaining 50 frames should take another 10 seconds. The "time left" is recalculated as the process continues, so it gets adjusted as the rate of reading increases or decreases.
(When reading the file for the first time, Wireshark doesn't know how many frames there are, so it gives no estimate. It counts the frames as it reads the file for the first time, so it knows it after that.)