Wireshark · Ethereal-dev: Re: [Ethereal-dev] Fast querying of offline captures

[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

On Mon, 28 Feb 2005, Evan Hughes wrote:

>    I've been doing some work with largish trace files (in the
> neighbourhood of 1gig), and I noticed that display filters can take a
> long time to execute. Has any consideration been given to using some
> kind of indexing to accelerate work filtering of large data sets?

Not that I am aware of although someone in Australia is feeding data from
Ethereal into an SQL database.

>    More importantly, does dealing with such huge files seem to be a
> common task, or am I just using ethereal in a way that it wasn't
> intended to be used?

Actually, quite common :-(

Regards
-----
Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org,
sharpe[at]ethereal.com, http://www.richardsharpe.com