Wireshark-dev: Re: [Wireshark-dev] tshark: drop features "dump to stdout" and "read filter" - c
From: Ulf Lamping <[email protected]>
Date: Wed, 10 Oct 2007 18:17:26 +0200
> I didn't follow the thread too closely, so it's just "my two cents".
> Be careful with the "temporary file model". Writing packets to disk can be 
> sloooow, so things can get even worse (you drop more packets because tshark 
> is slow *and* you are dumping to disk).
> At least on windows it looks like it's possible to increase the standard 
> buffer size of a named pipe upon creation. There are a lot of caveats to 
> this (see the remarks in the doc).
> http://msdn2.microsoft.com/en-us/library/aa365150.aspx
> Always on windows, consider that WinPcap already uses two buffers, one in 
> the kernel driver and another one within wpcap.dll. I don't think adding 
> another layer of buffering (being it a file on disk, a big pipe or what) 
> will solve the problem.

I don't know if increasing the pipe size is possible on all systems we support -  but it will probably be very system dependant to implement and to do it that way would probably show very system dependant pipe behaviour IMHO.

Regards, ULFL

Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!