The tool said it wrote 48 packets. Only 44 were thereRecap I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog postSep 21 · 5 min readrobinhayer.hashnode.dev
Concurrency Without a Parallel Parser: Splitting PCAPs by SessionWhere the last post left off In my first post about the 2.5 GB wall, streaming fixed memory. It didn't fix throughput. The pipeline was still one file, one tshark process, one core. Piping stdout to sAug 26 · 5 min readrobinhayer.hashnode.dev
The 2.5 GB Wall: Why My tshark Wrapper Died, and How Streaming Fixed ItThe tool that worked I built a CLI tool that wrapped tshark for PCAP analysis. Grab the file, send shell commands, let tshark analyze it, capture the output, shape it, return it. Quite simple, right. Aug 10 · 4 min readrobinhayer.hashnode.dev
