Termshark slower than Wireshark on multi-gigabyte pcap file about termshark HOT 2 CLOSED

Could it use capinfos - which will work its way through the pcap much more quickly than a tshark process that is generating XML output..

For getting the # of packets in a pcap, capinfos is the correct tool.

Multigig Pcaps

If you have a multigig pcap, I think it is expected to take longer. The solution here is to use a capture/display filters as part of the capture process. If you must have an unfiltered multigig pcap, there are tools to find what you're looking for. Especially given that termshark doesn't add much overhead to tshark processing, I don't think this should be the focus. The user has control over the size of capture and it's as simple as using -a -b -c.

(suggested title) Feature Request: Lazy load packets for a more responsive UI

Termshark is dependent on tshark -T psml, and currently will run through the whole pcap to generate the packet list, slowly updating the progress bar as it goes.

Can we just turn off the progress bar early, when enough packets have been loaded for several screens-worth of scrolling. All seems to add extra complexity.

This is the problem and I might retitle the issue. termshark should buffer $(arbitrary #) of packets from tshark and then show that to the user so termshark has a "responsive" UI. To be clear, nothing is broken per se, but having this feature is important to the UI.

from termshark.

Here's a link to a question I added to the FAQ: https://github.com/gcla/termshark/blob/master/docs/FAQ.md#how-much-memory-does-termshark-use

I'll close this issue now.

from termshark.