Re: tshark vs dumpcap

[Jim Aragon <Jim () agdatasystems com>]

At 06:23 AM 10/30/2011, Stuard Kendrick wrote:

>Is there any performance advantage to using dumpcap over tshark, for
>pure packet capture?  [Less chance of dropping frames perhaps?]

Probably. Tshark calls dumpcap to do the packet capture. So if you 
run tshark, you're running tshark and dumpcap. If you run dumpcap 
directly, you're only running dumpcap. At the very least, it seems to 
me that dumpcap would use less memory than dumpcap and tshark together.

Jim

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe