USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.44k stars 1.14k forks source link

Optimizations #137

Closed dc3-tsd closed 3 years ago

dc3-tsd commented 3 years ago

This merge request contains some optimizations to help improve processing speed.

This was made after the discovery that if dshell can't determine when a connection is closed, it will hold onto the connection in the _connection_tracker. This was causing the _connection_handler() to slow down proportionally to the number of lingering open connections.

This caused a 244 MB pcap to take multiple hours to complete. After these changes, processing only took 20 minutes.

dev195 commented 3 years ago

These changes look good and will be merged shortly.

A useful future feature might be to allow users to change the max connections and timeout values from the command-line, if they have the need and available memory for it.