blincoln's profile - activity

Those are both very helpful as well. Thank you :).

Thank you :).

Is there an option to set the follow stream view to something other than ASCII by default?

I'm looking at a packet capture of traffic that involves sending multi-MB XML blobs, and the blobs have no newline characters in them. Even on a recent laptop, WireShark is very slow to parse the stream when viewed in ASCII mode, on the order of 4 packets per second. I assume this is because of inefficiencies in soft-word-wrapping code either in WireShark itself or the OS. The total amount of traffic is something like 65MB, so even after a few hours, WireShark wasn't done following the stream. It runs at a reasonable speed in Hex Dump mode, but until I figured out the workaround below, I didn't think I could use that because the "Show data as" dropdown is greyed out until the stream has been parsed.

This is the workaround I'm using in the meantime: follow a different, shorter stream first. Wait for it to finish parsing. Switch to Hex Dump view. Change the Stream ID in the stream viewer to the ID of the problematic stream.

Option to control default follow stream view? Is there an option to set the follow stream view to something other than A