Sharon wrote:
> Another problem (?) I am facing:
>
> When working with big files, the tcpprep does not finish - when trying
> to split according to subnet ("CDIR") - consuming a lot of memory - till
> killed by the system...
>
> Any idea what can cause it?
>
> E.G.
>
> Dump file with 2.5M packets, 300 Mbyte size,ftp traffic between 20+
> client ip's & 1 server ip (a lot of sessions with a lot of port
> numbers...)
>
> ???
>
> Splitting with --regex="XXX" (e.g. --regex="(168)\..*" when my server-ip
> is 168.10.3.1) looks beter - means - command that does not finished with
> "CDIR" worked with "regex" but took a lot of time (10+ minutes to the
> above sample!)
>
> Is it the expected behavior?I haven't seen that problem, but it's been a long time since I've tested tcpprep w/ large files. Basically tcpprep will allocate 2bits of data for each packet in 100 byte increments for the cache. The result is roughly 600K of RAM for 2.5M packets- which isn't that much at all. It shouldn't take 10 minutes to process 300MB/2.5M packets unless your box is already heavily loaded and has really crappy disk IO (I assume you're not doing this over NFS on a busy network right? :) Could you provide the exact command you're running? This is with 3.0+patch right? Any chance you can compress and upload that 300M file somewhere for me to download? That would allow me to reproduce your environment a lot more closely and save me time- which considering how busy I am right now (working 7days/week) would really help. If you don't have some place to upload the file yourself, I'm sure I can work something out on my end. -- Aaron Turner http://synfin.net/ http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
