Wireshark-dev: Re: [Wireshark-dev] Tshark XML conversion
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Wed, 22 Jul 2009 23:23:33 +0200
On Wed, Jul 22, 2009 at 03:03:49PM +0200, Wasim Bari wrote:
> 
>    I just converted 1.5 Gbyte file to XML and it took about 13 minutes. And
>    the size of output xml file was 72 Gbyte which is very strange for me. Am
>    I doing something wrong or is it normal behaviour ?

Yes it is. Well, at least the increase in filesize is. Imagine the ip
source address. It takes up 4 bytes in the actual packet, but in text it
is already 7-15 bytes long (1.1.1.1 and 111.111.111.111). Add to that
the XML tags and you can imagine that the file blows up quite quickly...


>    Secondly can  get output in text mode with full details ?  (I saw text
>    option but it only gives me summary)

Try 'tshark -V'

('tshark -h' and 'man tshark' are your friends :-))


Cheers,


Sake