Wireshark-dev: Re: [Wireshark-dev] tshark: drop features "dump to stdout" and "read filter" - c
From: Ulf Lamping <[email protected]>
Date: Wed, 10 Oct 2007 18:17:26 +0200
> 
> I didn't follow the thread too closely, so it's just "my two cents".
> 
> Be careful with the "temporary file model". Writing packets to disk can be 
> sloooow, so things can get even worse (you drop more packets because tshark 
> is slow *and* you are dumping to disk).
> 
> At least on windows it looks like it's possible to increase the standard 
> buffer size of a named pipe upon creation. There are a lot of caveats to 
> this (see the remarks in the doc).
> 
> http://msdn2.microsoft.com/en-us/library/aa365150.aspx
> 
> Always on windows, consider that WinPcap already uses two buffers, one in 
> the kernel driver and another one within wpcap.dll. I don't think adding 
> another layer of buffering (being it a file on disk, a big pipe or what) 
> will solve the problem.
> 

I don't know if increasing the pipe size is possible on all systems we support -  but it will probably be very system dependant to implement and to do it that way would probably show very system dependant pipe behaviour IMHO.

Regards, ULFL


_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066