Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Decoding / Displaying Large Capture Files

From: "Barry Constantine" <Barry.Constantine@xxxxxxxx>
Date: Thu, 24 Jul 2008 12:20:03 -0700

Hello,

 

I am aware that one can use editcap to split large files into smaller capture files to improve Wireshark decode / display performance.

 

Is there any way to optimize Wireshark when to read in large files without splitting first?  Some commercial protocol analyzers read in the first so many packets, display them, while the rest are being read in.

 

Thanks,

Barry