> > I didn't follow the thread too closely, so it's just "my two cents". > > Be careful with the "temporary file model". Writing packets to disk can be > sloooow, so things can get even worse (you drop more packets because tshark > is slow *and* you are dumping to disk). > > At least on windows it looks like it's possible to increase the standard > buffer size of a named pipe upon creation. There are a lot of caveats to > this (see the remarks in the doc). > > http://msdn2.microsoft.com/en-us/library/aa365150.aspx > > Always on windows, consider that WinPcap already uses two buffers, one in > the kernel driver and another one within wpcap.dll. I don't think adding > another layer of buffering (being it a file on disk, a big pipe or what) > will solve the problem. >
I don't know if increasing the pipe size is possible on all systems we support - but it will probably be very system dependant to implement and to do it that way would probably show very system dependant pipe behaviour IMHO. Regards, ULFL _____________________________________________________________________ Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! http://smartsurfer.web.de/?mc=100071&distributionid=000000000066 _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
