Wireshark · Ethereal-users: Re: [Ethereal-users] Slow packet capture from file

[Guy Harris <guy@xxxxxxxxxx>]

> Hmm, sorry about the imprecise language. I am indeed reading from a file,
> /tmp/capture.tmp to be exact.

OK, then I'm not sure why it's doing repeated "recvfrom()" calls if
that's *not* reading from a live capture socket.

Could you try starting Ethereal under strace, and send me an indication
of what it's doing, all the way up to the point where it starts reading
the file?

> The first half of that file was generated by
> tcpdump, the second half of the file was generated by snoop -v.

"snoop -v", or "snoop -w"?  "snoop -v" generates a text file that
Ethereal can't read.

Precisely what was the full process used to generate the file?