Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to find out how to measure the parsing time of a PCAP file when using Wireshark.

Does anyone know how to do this?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Not sure exactly what you are trying to do, but it may be impossible to do whatever that is. Calculating it accurately would be impossible without knowing enough of the variables that go into it, and measuring it would only accurately apply to a particular PCAP file on the same system/installation.

To get an idea of the variables that play a part in how long it would take to parse, here are some of them:

  • the hardware/computer parsing the file (disk I/O, memory, CPU)
  • the OS Wireshark is running on
  • the contents of the PCAP (number of packets, how much payload, etc)
  • the user configurable settings within Wireshark (which data needs to be pulled for the selected columns, coloring rules, etc)
share|improve this answer

Not sure what you are trying to accomplish but you could try:

time tshark -r foo.pcap  > /dev/null

This is just parsing; no filtering is done.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.