Consider using sharkd when it's available
gcla opened this issue · 0 comments
gcla commented
One of the first comments I received on termshark's initial release was did I consider using sharkd instead of tshark... I didn't, but out of ignorance! Sharkd is a daemon with a JSON interface that supports loading pcaps, checking filters, and various other tshark operations. It would have two main advantages:
- it would be faster for things like filter syntax checking because I wouldn't need to run a separate process each time
- it would be better for large pcaps because I wouldn't need the optimizations around loading pdml in chunks, reducing complexity a lot
The main disadvantages, afaict, are that
- sharkd isn't bundled on Windows.
- I can't see a way to get psml and pdml from it (but I must be missing that, surely)