Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 11698] Rescanning file with dispaly filter is much slower

Date: Fri, 13 Nov 2015 02:06:51 +0000

Comment # 4 on bug 11698 from
The pcap trace is not big enough to reproduce this issue. Actually the pcap
size is not the key to reproduce this issue. The loading and filtering speed of
wireshark depends on the packet number. For example, you will observe this
issue with below pcap file with about 6 million packets.

I used offical wireshark version WiresharkPortable_2.1.0-497-gf2ac2e4.paf.exe
to test below test.pcap file.
1. open test.pcap with display filter data.data[0] == 0x2b, the loading
procedure costs 22.627 seconds.

2. open test.pcap with no display filter
   rescan packet with display filter data.data[0] == 0xdf, the filtering
procedure  costs 45.337 seconds.

The test.pcap is compressed with 7zip and the compressed size is 34.3 MB.
http://yunpan.cn/cLYQqnb6We4Lg  password: 2114


You are receiving this mail because:
  • You are watching all bug changes.