Comment 2 for bug 386199

To examine the libpcap trace, open it with Wireshark, right-click on the first packet, and choose "Decode as". In the window that appears select the "Transport" tab, then the "X11" protocol in the list. Hit apply, then close.

You'll now see the decoded X11 traffic. (Note that this traffic is for the WHOLE SERVER, not just Evolution).

It's also informative to use the I/O graph. From the main menu, hit Statistics->I/O graphs. The first hump is moving the pointer to the "new" button and clicking on it, then moving the pointer out of the Xephyr window to wait for the compose window to appear. There's then a long period of steady low-rate traffic corresponding to the period when Evolution is non-responsive (from around seconds 6-18 in this particular trace), followed by a spike as it sets up and draws the window.

(I've attached a PNG of the graph, but if you actually fire up Wireshark and generate it yourself you'll be able to click on parts of it to move the main window's selection to that part of the timeline.)

The long flat period, when examined, appears to be a continuous loop of the following X11 operations:

(C: X11 client; S: X11 server):

C->S: Requests: Grabserver, QueryPointer
S->C: Reply: QueryPointer
C->S: Requests: QueryPointer
S->C: Reply: QueryPointer
C->S: UngrabServer

There are over 400 such repetitions in the particular sample I'm examining right now. Most are looping one after the other, but some are intermixed with other operations before or after the long slow period. However, at this point I'm not 100% sure they're even from Evolution.