microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
652 stars 114 forks source link

Add write buffer to improve performance #59

Closed maolson-msft closed 2 years ago

maolson-msft commented 2 years ago

Even though it adds a copy to the end-to-end datapath, writing bytes to a 50KB buffer and only calling WriteFile once the buffer has filled up makes etl2pcapng more than ten times faster.

Test file: 500MB Previous etl2pcapng version: 50sec to convert This new version: 4sec to convert