How to measure Wireshark parsing time of PCAP file?

Question

I need to find out how to measure the parsing time of a PCAP file when using Wireshark.

Does anyone know how to do this?

Answer 1

Not sure exactly what you are trying to do, but it may be impossible to do whatever that is. Calculating it accurately would be impossible without knowing enough of the variables that go into it, and measuring it would only accurately apply to a particular PCAP file on the same system/installation.

To get an idea of the variables that play a part in how long it would take to parse, here are some of them:

• the hardware/computer parsing the file (disk I/O, memory, CPU)
• the OS Wireshark is running on
• the contents of the PCAP (number of packets, how much payload, etc)
• the user configurable settings within Wireshark (which data needs to be pulled for the selected columns, coloring rules, etc)

Answer 2

Not sure what you are trying to accomplish but you could try:

time tshark -r foo.pcap  > /dev/null

This is just parsing; no filtering is done.