How to analyse a 5 GB PCAP without opening Wireshark
Start with cheap metadata and aggregate passes. Reduce the capture to the time, hosts or protocol you need before asking any tool to render millions of rows.
1. Inspect the file without decoding every packet
capinfos, shipped with Wireshark, reports file type, encapsulation, packet count, duration, byte rate and capture metadata:
capinfos capture.pcapngThis tells you whether “5 GB” represents a short high-rate burst or hours of traffic, and whether the file contains multiple interfaces. Check available disk space before creating extracts: a source file plus temporary and indexed data can require much more than the original file size.
2. Produce command-line summaries
Use tshark statistics with -q so it does not print a line for every packet:
# Protocol hierarchy
tshark -r capture.pcapng -q -z io,phs
# IPv4 conversations
tshark -r capture.pcapng -q -z conv,ip
# TCP conversations
tshark -r capture.pcapng -q -z conv,tcp
# Traffic per one-minute interval
tshark -r capture.pcapng -q -z io,stat,60Each command still reads the file, but memory use and terminal output are far lower than populating an interactive packet table. The official tshark manual describes the available statistics and read filters.
3. Extract a smaller working set
Use editcap for time or packet-number slices, or tshark when selection depends on decoded fields:
# First 500,000 packets
editcap -r capture.pcapng first-500k.pcapng 1-500000
# Only traffic involving one host
tshark -r capture.pcapng -Y "ip.addr == 10.20.30.40" \
-w host-10.20.30.40.pcapng
# Only DNS traffic
tshark -r capture.pcapng -Y "dns" -w dns-only.pcapngFor repeated analysis, create one focused extract and work from it. Avoid running a dozen full passes over the original on slow network storage.
A display filter (-Y) requires tshark to dissect packets before deciding what to keep. A read filter (-R with two-pass processing where appropriate) or a capture-style filter applied during collection can reduce later work, but choose carefully: filtering too early can remove packets needed to explain the incident.
4. Plan resources and limits
- Work from local SSD rather than a remote share when possible.
- Keep enough free space for the capture, extracts, database and exports.
- Prefer aggregate reports before packet-by-packet queries.
- Split by time boundaries if the incident window is known.
- Record the hash of the original and do analysis on copies if evidence integrity matters.
Manual method vs PCAPNG Analyzer
Manual method
- Run
capinfos. - Generate protocol and conversation statistics with tshark.
- Extract relevant hosts, protocols or times.
- Open only the reduced file when interactive inspection is needed.
With PCAPNG Analyzer Pro
- Set the reverse proxy and app upload limits for up to 5120 MB.
- Upload the file, or bind-mount a capture folder and use auto-ingest.
- Review the generated protocol, talker, conversation, DNS, HTTP and TLS summaries.
- Filter and page through packets without rendering the whole file at once.
The Pro entitlement permits uploads up to 5120 MB. Your deployment must also allow that request size, and the configured parse timeout, packet-row ceiling and disk quota must suit the capture. The self-hosting guide's Caddy example already sets a 5120 MB body limit.
Analyse large captures on your own server
PCAPNG Analyzer Pro supports files up to 5120 MB and keeps the capture on infrastructure you control.
See Pro featuresRead the setup guide