Ethereal-users: Re: [Ethereal-users] tethereal killed

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Mon, 29 Nov 2004 13:53:03 -0800 (PST)
Paul Wozney said:
> It's not always the same length of time, nor is it after
> the capture file is a certain size.  I notice that as tethereal runs
> it eats ram constantly; does this not seem strange behavior as it is
> writing it to a file?

No, because you're using a display filter, which requires that it dissect
packets to build protocol trees.  Packet dissection is stateful, so the
memory used will increase over time, although, unless reassembly is being
done, it shouldn't increase quickly over time.

> Would it be helpful if I attach the capture file?

Yes, because then I could see why the BPF filter for "net 10.1.1" isn't
matching packets.