Wireshark · Ethereal-dev: [Ethereal-dev] Re: Improving filter speed

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

still   even 120 ->110 is a ~10% decrease in filtering speed which is
very useful.


some of us do look at and refilter captures for a substantial part of
the day   and we also refer to captures smaller than 400MB as
capturelet :-) we would LOVE this.



On Wed, 16 Mar 2005 23:09:59 +0000, didier <dgautheron@xxxxxxxx> wrote:
> Gilbert Ramirez wrote:
> > What kind of speed improvements are you seeing? Timing it with
> > tethereal will probably be easier than with ethereal.
> > 
> > --gilbert
> if with unpatched ethereal I have saying:
> load with no filter (display or color) 70 secondes
> with a filter (time is rather constant it's you have a filter or not) 
> 120 secondes.
> 
> with the patch
> load with no filter 70s
> applying a  color filter between 80 and 110s (now what's in the filter 
> matter).
> 
> 'simple' display filters  ie only protocol name are faster than loading 
> without filter.
> 
> Didier
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>