Wireshark-dev: Re: [Wireshark-dev] Building for Windows without zlib?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Thu, 27 Sep 2012 20:30:30 +0200
Hi,

On Thu, Sep 27, 2012 at 03:53:29PM +0100, Martin Mathieson wrote:
> At one stage, building without zlib support meant that opening/reading
> files was much faster than with.

Old wiretap when you disable zlib was using fread() to read data.
Right now we have our own I/O routines [copied from zlib, slighty modified],
which is used also when you disable zlib.

There were some discussion about performance hits in bug #5802[1],
I have done some benchmarks (on Linux), and times were almost the same.

IMHO reading packets is fast, and main speed problem is with dissecting packets.
But well it's easy to check, you can meatume time of: capinfos -c your/file.pcap
and compare it with tshark

That said, we can optimize reading files on Windows, for example use 
WinAPI [CreateFile(), ReadFile()] instead of msvcrt wrappers [open(), read()].


[1] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5802#c12