Wireshark-users: Re: [Wireshark-users] Capture machine spec?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Tue, 20 Jun 2006 11:30:11 +0800


David Meagher wrote:

Hi,
I've been tasked with spec'ing a capture analysis machine.
It will be used to do analysis of multiple 500mb capture's.

Can some one suggest a spec for a desktop pc to view these on?
Is ram more of an issue than CPU, or perhaps a sata/raid storage?

My laptop (1.6ghz pentium M with 512mb) is just toooo sloooooooooow.
You need RAM to keep Wireshark running (especially with large captures)--it will abort if it runs completely out of memory (including swap space). I've read that others use a general rule of having 10 (??) times the size of the capture file in RAM; personally when I have a doubt about the size of my capture file, I load it on a machine with 16 Gb of RAM, that's usually enough for me. For some suggestions on limiting Wireshark's memory usage, see: 

http://wiki.wireshark.org/KnownBugs/OutOfMemory

As for CPU power, it just depends on how long you want to wait...  :-)