I’ve noticed that in the linux version, wireshark displays the packets while reading them. I would think that if it didn’t, file reading might be faster. Is there a config setting in the program to totally turn of packet display during file load, or a setting in the build (.configure && make && make install) to turn that off.
thanks
john
Hello,
Since Wireshark will finally display (into “packet list”) all packet at the end (no ?),
I do not think there is a difference.
Did you have removed “colorize packet list” option (into view menu or using icon into toolbar) ?
When “colorize packet list” option is set, the dissector analyse the entire data of the packet.
When “colorize packet list” option is unset, the dissector analyse only the “header” of the packet.
This could give a big performance difference.
Olivier