Guides / Large captures

How to analyse a 5 GB PCAP without opening Wireshark

Start with cheap metadata and aggregate passes. Reduce the capture to the time, hosts or protocol you need before asking any tool to render millions of rows.

By Stuart Mathieson8 minute readcapinfos + tshark + editcapUpdated 12 October 2026

The quick way

PCAPNG Analyzer Pro takes captures up to 5 GB and does the heavy lifting on your server. You get the summaries, health ratings and findings without loading millions of rows into a desktop application, and page through packets only when you need them. Raise two limits first, as described at the end of this guide.

See network health in a sample report →

1. Inspect the file without decoding every packet

capinfos, shipped with Wireshark, reports file type, encapsulation, packet count, duration, byte rate and capture metadata:

capinfos capture.pcapng

This tells you whether “5 GB” represents a short high-rate burst or hours of traffic, and whether the file contains multiple interfaces. Check available disk space before creating extracts: a source file plus temporary and indexed data can require much more than the original file size.

2. Produce command-line summaries

Use tshark statistics with -q so it does not print a line for every packet:

# Protocol hierarchy
tshark -r capture.pcapng -q -z io,phs

# IPv4 conversations
tshark -r capture.pcapng -q -z conv,ip

# TCP conversations
tshark -r capture.pcapng -q -z conv,tcp

# Traffic per one-minute interval
tshark -r capture.pcapng -q -z io,stat,60

Each command still reads the file, but memory use and terminal output are far lower than populating an interactive packet table. The official tshark manual describes the available statistics and read filters.

3. Extract a smaller working set

Use editcap for time or packet-number slices, or tshark when selection depends on decoded fields:

# First 500,000 packets
editcap -r capture.pcapng first-500k.pcapng 1-500000

# Only traffic involving one host
tshark -r capture.pcapng -Y "ip.addr == 10.20.30.40" \
  -w host-10.20.30.40.pcapng

# Only DNS traffic
tshark -r capture.pcapng -Y "dns" -w dns-only.pcapng

For repeated analysis, create one focused extract and work from it. Avoid running a dozen full passes over the original on slow network storage.

Reduce the file once, then reuse the extract.

Both -Y and -R are display filters, so tshark still dissects every packet to evaluate them; -R (which requires two-pass mode, -2) is not a faster alternative. The real savings come from a capture filter applied during collection, or from cutting one smaller extract and working from it. Choose carefully: filtering too early can remove packets needed to explain the incident.

4. Plan resources and limits

Work from local SSD rather than a remote share when possible.
Keep enough free space for the capture, extracts, database and exports.
Prefer aggregate reports before packet-by-packet queries.
Split by time boundaries if the incident window is known.
Record the hash of the original and do analysis on copies if evidence integrity matters.

Manual method vs PCAPNG Analyzer

Manual method

Run capinfos.
Generate protocol and conversation statistics with tshark.
Extract relevant hosts, protocols or times.
Open only the reduced file when interactive inspection is needed.

With PCAPNG Analyzer Pro

Raise the packet and parse-time limits in Settings → Limits to fit the capture (capinfos shows its packet count).
Upload the file, or drop it into a watched folder.
Read the health verdict, findings and summaries, then filter and page through packets as needed.

Before processing a 5 GB file

The Pro entitlement permits uploads up to 5120 MB, but the default server limits are set for smaller captures. Only the first 1,000,000 packets are analysed by default (the app says so when this happens), and a 5 GB capture usually holds several million, so raise the packet limit above the count capinfos reports. Allow more parse time than the default 600 seconds too. Both are in Settings → Limits. The stored-capture disk cap (MAX_DISK_USAGE_MB, 10 GB by default) only has room for two 5 GB files, so raise it if the disk allows. Your reverse proxy must also accept the upload: Caddy, as used in the self-hosting guide, sets no request-body limit by default; nginx defaults to 1 MB, so raise client_max_body_size if you use it.

Analyse large captures on your own computer or server

PCAPNG Analyzer Pro supports files up to 5120 MB and keeps the capture on infrastructure you control.

See Pro features Read the setup guide