Quick Load

Overview

Quick Load mode provides a way to display the first 5,000 packets on screen faster than it would take to load the entire file, dramatically reducing the time users wait to see initial packet data while large files load in the background.

This feature works by reading only the first 5,000 packets from the file in parallel with loading the entire capture. Since reading 5,000 packets takes constant time regardless of total file size, this provides substantial performance improvements for large captures - users can start analyzing data immediately rather than waiting for complete file processing.

Quick Load combines this accelerated packet loading with a significantly faster /status endpoint to populate packet counts, duration, and file size fields, delivering a much more responsive user experience when working with larger files.

How It Works

Quick Load uses a truncated session containing the first 5,000 frames for initial packet list and decode tree operations. When a display filter is applied, the system first searches the truncated copy in memory, providing dramatically faster filter responses on large files - with the caveat that speed improvements only apply if the filter matches packets within the first 5,000 frames.

The system automatically continues scanning the rest of the file for additional matches in the background, just like normal operation. This approach leverages the fact that once a file is loaded into memory, frame decode requests are fast, but changing the display filter requires a re-scan of the whole file. By using a smaller preview file for the first 5,000 packets, Quick Load delivers a much more responsive user experience while the complete file loads.

Enabling in the UI

Enable Quick Load mode by adding the quickLoad prop to your PacketViewer component:

import { PacketViewer } from "@qacafe/pv-react";
import "@qacafe/pv-react/style.css";

function MyPacketAnalysis() {
  return (
    <PacketViewer
      /** A file name or URI to load PCAP data from on the API server */
      file="large-capture.pcap"
      /** The name of the profile to open the PCAP file with */
      profile="default"
      /** The URI endpoint of the API service */
      endpoint="/api"
      /** Enable Quick Load mode for faster initial loading */
      quickLoad={true}
    />
  );
}

Quick Load is also available in the Packet Sequence View (Ladder):

import { PacketSequenceView } from "@qacafe/pv-react/views";

function MySequenceDiagram() {
  return (
    <PacketSequenceView
      file="large-capture.pcap"
      endpoint="/api"
      quickLoad={true}
    />
  );
}

When Quick Load is active, a status indicator will appear in the footer status bar showing the feature is enabled.

Available Components

Quick Load mode is supported in:

• PacketViewer component
• PacketSequenceView (Ladder diagram)

Performance Trade-Offs

Quick Load opens and maintains two sessions in memory: one containing only the first 5,000 packets and another for the complete file. This approach has several implications:

• Memory Usage: Requires additional memory to store the truncated session alongside the full file
• Small File Performance: May actually be slower for small files since they don’t benefit from this optimization, though the performance difference is typically negligible for files that load quickly anyway
• Resource Management: The sharkd-idle-timeout configuration variable is still respected, so sessions will be closed after the configured idle time

Caveats

The decode pane for the first 5,000 packets uses data from the truncated session, which can lead to some missing cross-packet information when conversations span beyond the 5,000-packet boundary.

Missing Conversation Details

Conversation-related fields like “Response in” may be absent if the referenced packets lie outside the first 5,000 frames. For example, consider a DNS query in packet 2,500 with its response in packet 7,200 - the query’s decode tree won’t show the “Response in frame 7200” field because that information isn’t available in the truncated session.

This inconsistency only affects packets 1-5,000 when they reference packets beyond frame 5,000. Packets numbered higher than 5,000 are always decoded from the complete file and will show all conversation details correctly.

Follow Stream Behavior

Follow Stream functionality always uses the complete file, ensuring stream reconstructions are always complete and accurate regardless of which packet initiated the stream view.

Component Architecture

Quick Load mode is not currently available in the <PacketViewerProvider> component composition mode, but support will be added in a future release.

Customizing the Pre-loaded Packet Count

Integrators are currently unable to change the default count of 5,000 packets that are loaded first. This value was chosen as a balance between loading speed and providing sufficient data for initial analysis on typical systems.