Wireshark · Ethereal-dev: Re: [Ethereal-dev] Regarding Memory allocation

[Guy Harris <gharris@xxxxxxxxx>]

harshas wrote:

> If the number of messages in the file is more(say more than 1000) than
> ethereal
>  exits with seg fault.(I am using LINUX machine).
> 1. I feel LINUX machine somewhere fails to allocate such an ammount of
> memory to the process in which ethereal is runing? is it so?

I suppose it's possble, but I've read captures with *many* more packets 
than 1000.

> 2. Do you feel it is the problem with my code?(It works upto 500 messages).

It's possible that there's a bug somewhere in your code (and it's 
possible that the bug has nothing to do with the number of packets in 
your capture).  Try running it under gdb and see what the stack trace is 
when it crashes with the segmentation fault.

> 3. Sir I want to know why reassembly is done

So that a packet that's fragmented across more than one link-layer 
packet (IP fragmentation, splitting a packet across two or more TCP 
segments, etc.) can be fully dissected.

> and what happens during reassembling.?

The data from all of the fragments is collected and combined into a 
buffer in memory and saved.  When dissecting the last link-layer packet, 
a new tvbuff is constructed that refers to the reassembled data, and 
that's what's used to dissect the higher-level packet of which the 
link-layer packet is the last component.