Wireshark-users: Re: [Wireshark-users] Wireshark Performance on Laptops
From: "Phillips, Christopher M" <[email protected]>
Date: Fri, 21 Aug 2009 09:56:14 +0100

I did a lot of testing on Toshiba based laptops on a 1GBit link with about 800Mb/s average traffic.


Personally I would go the highest cpu you can afford with the least number of cores.  OS would have to linux, my own tests get better filter responses and you main reason is you can avoid the windows per process memory limit.


Also for long term captures linux will stay up longer without reboot. 


Avoid the SSD at all costs if you are doing large captures such frequent writes would reduce its lifespan a lot and highspeed harddrives are more appropriate for fast large block writes (on a non fragmented disk).  SSDs will save your battery, are quieter, and have much better random access time so for os like windows which makes lots of tiny reads and writes all over the disk its better.  Many SSDs will only write sequentially and you can get into problems when your partition does not full onto the right boundary of the sector layout on the disk.  Unlike HDs SSDs often have to erase a previously used sector before writing and if the Filesystem allocation unit goes across to sectors then you have two erase cycles before you can even write to the thing.


I would suggest if you can get a system with two harddrives have one ssd for the os and one hd for the capture would be ideal.





-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Sake Blok
Sent: 20 August 2009 21:48
To: [email protected]
Subject: [Wireshark-users] Wireshark Performance on Laptops


Hi All,


I'm in the process of buying a laptop and I am not sure what to go for. I will use the laptop mostly for making and analysing tracefiles. I bet some of you had to make the same choice before, so I might as well learn from your experience :-)


My choices (at the moment) are a DELL (XPS 16 or 6400) running Linux or a MacBook Pro 17" (all have a 2.8 or 3.06 Ghz core-2-duo and 4GB or more 1066Mhz DDR3 and either a SSD or 7200RPM HDD). Does anybody did some performance testing on similar laptops?


I'm curious about:

- When capturing, how well do Linux and MacOS/X perform on a full Gbit link?

- When analysing, is there a big difference in performance between Linux and MacOS/X (using the same CPU and memory)?

- Did anyone compare Wireshark (filtering) performance on SSD's and HDD's (7200RPM)?

- What laptops / OS are you using, how well does it perform and why did you come to choose this laptop?