Since version 0.10.15 you can use dumpcap for this (or e.g. Stop other programs running on that machine, to remove system loadĪs both Wireshark and TShark are not optimized for speed on specific operating systems, use a 'capture only' program to capture packets and use Wireshark/TShark later to do the analysis. As your machine was too slow to handle the incoming packet rate some packets had to be discarded. What has happened? Not all packets coming in from the network could be saved into the capture file. The things that may help: Add more physical RAM and use a faster CPU (multi core CPU's won't help a lot, the dissection is done in a single task) Packet drops while capturingĪfter you've finished a capture, you've noticed packet drops, indicated by the statusbar counter. packet dissection - fine tune the Preferences.Harddisk -> packet dissection -> display filter / coloring rule -> display To do this, the following gives some insights which parts are worth looking at. If the above hints didn't help, you may need to advance your machine. TCP/Allow subdissectors to reassemble TCP streams.You may need to reload the file after changing the settings (and don't forget to press the 'Save' button :-). You can check if that's the case, by loading a capture file, setting a display filter of the packet types in question and see if the number of displayed packets are the same with and without these settings. So maybe you miss packets that are missinterpreted. Be aware that these features are probably required to detect the packets properly that you want to capture. On MacOS X, disabling Transport Layer lookups under View->Name Resolution can help speed things up.ĭisabling some preference settings may save you a lot of memory consumption. You could also delete all coloring rules or rename the coloring rules file.ĭisable Network Layer (hostname) DNS lookups under View->Name Resolution can help speed things up To disable these rules, use View->Colorize Packet List. There are some things you can do, but unfortunately this will remove some decoding comfort:ĭisable Coloring Rules: this will significantly increase performance. > 100MB, Wireshark will become slow while loading, filtering and alike actions.

There are two main topics where performance currently is an issue: large capture files and packet drops while capturing. Some tips to fine tune Wireshark's performance.

Wireshark packet capture file