Wireshark-bugs: [Wireshark-bugs] [Bug 4806] Huge pcap files are also completely loaded into memo
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 29 May 2010 04:03:09 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4806

--- Comment #1 from Anders Broman <anders.broman@xxxxxxxxxxxx> 2010-05-29 04:03:07 PDT ---
Unfortunately that's not so easy, Wireshark does NOT hold the entire file in
memory but keep state information of packets, reassembly data etc in memory.
Unfortunatly it's not possible to predict the amount of memory neeeded for any
particular trace file as it depends on the protocols contained in the file and
the users preference settings. There is no owerall tracking of memory consumed
rather memmory is allocated as needed bu the various functions called when
dissecting a packet.
The glib memory allocation functions used give no warning when memory is
exhaused and even it the more modern versions where used the above problems
would still have to be adressed some how.
Regards
Anders

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.