Wireshark-dev: Re: [Wireshark-dev] tshark: drop features "dump to stdout" and "read filter" - c
>
> I didn't follow the thread too closely, so it's just "my two cents".
>
> Be careful with the "temporary file model". Writing packets to disk can be
> sloooow, so things can get even worse (you drop more packets because tshark
> is slow *and* you are dumping to disk).
>
> At least on windows it looks like it's possible to increase the standard
> buffer size of a named pipe upon creation. There are a lot of caveats to
> this (see the remarks in the doc).
>
> http://msdn2.microsoft.com/en-us/library/aa365150.aspx
>
> Always on windows, consider that WinPcap already uses two buffers, one in
> the kernel driver and another one within wpcap.dll. I don't think adding
> another layer of buffering (being it a file on disk, a big pipe or what)
> will solve the problem.
>
I don't know if increasing the pipe size is possible on all systems we support - but it will probably be very system dependant to implement and to do it that way would probably show very system dependant pipe behaviour IMHO.
Regards, ULFL
_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066
