Why tshark chokes on 2.5GB PCAPs, and how streaming fixed it
A tshark wrapper that purred on small PCAPs collapsed at 2.5GB: six to seven hours of processing and repeated OOM crashes. The culprit was a triple read of the file, tshark's single-threaded core, and building full JSON in memory. The fix was consolidating to one query and streaming tshark's output into Go, collapsing the job to about 70 minutes. A sharp case study in why memory-bound designs fail at scale.