Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5111] Backward filtered searches in compressed captures is

Date: Wed, 6 Jun 2012 18:51:33 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5111

Chris Maynard <christopher.maynard@xxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |1.5.x (Experimental)

--- Comment #1 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2012-06-06 18:51:32 PDT ---
With SVN r43144, on Windows 7 64-bit, I ran some tests on 3 different
compressed capture files:

File 1, 231MB standard pcap file, gzipped to 218MB:
Forward search from frame 1 for "frame.number eq 223729": ~4 seconds.
Backward search from frame 223729 for "frame.number eq 1": ~2 mins 49 secs.

File 2, 600+MB standard pcap file, gzipped to ~10MB:
Forward search from frame 1 for "frame.number eq 509081": ~6 seconds.
Backward search from frame 509081 for "frame.number eq 1": ~7 mins 35 secs.

File 3, 500+MB pcap-ng file, gzipped to ~8MB:
Forward search from frame 1 for "frame.number eq 373698": ~5 seconds.
Backward search from frame 373698 for "frame.number eq 1": ~5 mins 36 secs.


So, while it takes considerably longer to search up (backward) as compared to
down (forward), it was nowhere near the hour+ search reported with 1.5.0, and
more importantly, Wireshark never hung and the progress bar did show the slow
progress.  Furthermore, on a subsequent test, clicking on the "Cancel" button
did cancel the search, although there was a slight delay from when it was
clicked until the search was actually cancelled.

Things have changed quite a bit since 1.5.0, so maybe you can retest with a
more recent version and see if this bug can be closed now?

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.