Wireshark · Wireshark-dev: Re: [Wireshark-dev] memory allocation assertion failure reading 219MB file with 1.2Million packets

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Guy Harris wrote:
> Ravi Kondamuru wrote:
>
> > My question:
> > Is there a known limit on the number of packets that wireshark can deal 
> > with in a single file?
>
> The number of packets that Wireshark (or, I suspect, any network 
> analyzer) can deal with is limited; due to a number of factors, the GUI 
> widget used to implement the packet list display being one of them (it 
> allocates a string for the text value in every column, which eats a lot 
> of memory), Wireshark's limit might be lower than some other analyzers.
>
> This is not a limit saying something such as "Wireshark can't read more 
> than 1,227,399 packets"; the point at which it'd run out of memory 
> depends on the contents of the packets.

See this page for more info:

http://wiki.wireshark.org/KnownBugs/OutOfMemory