Hi,
On Thu, Sep 27, 2012 at 03:53:29PM +0100, Martin Mathieson wrote:
> At one stage, building without zlib support meant that opening/reading
> files was much faster than with.
Old wiretap when you disable zlib was using fread() to read data.
Right now we have our own I/O routines [copied from zlib, slighty modified],
which is used also when you disable zlib.
There were some discussion about performance hits in bug #5802[1],
I have done some benchmarks (on Linux), and times were almost the same.
IMHO reading packets is fast, and main speed problem is with dissecting packets.
But well it's easy to check, you can meatume time of: capinfos -c your/file.pcap
and compare it with tshark
That said, we can optimize reading files on Windows, for example use
WinAPI [CreateFile(), ReadFile()] instead of msvcrt wrappers [open(), read()].
[1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5802#c12
