Wireshark-users: Re: [Wireshark-users] how to handle big files in wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ian Schorr <ian.schorr@xxxxxxxxx>
Date: Sat, 10 Jul 2010 11:27:25 +1000
Yes, tshark generally requires much less memory, from need not to
build the packet list (which comprises a very significant portion of
the Wireshark memory usage) and some of the structures not maintainted
through multiple passes.  It's quite powerful, and I use it in many
cases specifically because of capture size.

-Ian

On Sat, Jul 10, 2010 at 10:36 AM, Bryan Hoyt | Brush Technology
<bryan@xxxxxxxxxxx> wrote:
> Have you looked at tshark at all? ...
> I don't know for sure, but I'd assume that it uses significantly less memory
> than Wireshark, because I don't think it would try to load the whole file at
> once.