Wireshark-users: Re: [Wireshark-users] tshark vs dumpcap
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jim Aragon <Jim@xxxxxxxxxxxxxxxxx>
Date: Sun, 30 Oct 2011 17:10:43 -0700
At 06:23 AM 10/30/2011, Stuard Kendrick wrote:

>Is there any performance advantage to using dumpcap over tshark, for
>pure packet capture?  [Less chance of dropping frames perhaps?]

Probably. Tshark calls dumpcap to do the packet capture. So if you run tshark, you're running tshark and dumpcap. If you run dumpcap directly, you're only running dumpcap. At the very least, it seems to me that dumpcap would use less memory than dumpcap and tshark together.

Jim