Wireshark · Wireshark-dev: Re: [Wireshark-dev] memory allocation assertion failure reading 219MB file with 1.2Million packets

[Ulf Lamping <ulf.lamping@xxxxxx>]

ronnie sahlberg wrote:
> i think significant parts of the utilized memory is memory allocated 
> by wireshark itself for things like reassembly  and state management 
> of protocols.
>
> since most se allocation is done from within a dissector
> once more/most of this is converted to use emem allocators  we could 
> maybe do something like :
>
> 1, set an upper limit on how much memory we allow to be allocated by 
> the se allocator
> 2, when se_alloc is called and we have reached this limit,   just 
> cause a new exception MemError
> to cause dissection of the packet to be aborted but allow wireshark to 
> continue.
>
> this might actually work
I tried something different recently, but failed to get a reliable 
solution (at least on Win32):

Before the loading of a packet, get the amount of free memory from the 
system and stop loading packets when only a specific amount is left.

Depending on the threshold to stop, this ended up in:

- if the threshold is too high, leaving too much memory unused
- if the threshold is too low, running out of memory before the 
threshold triggered

This may be caused by the allocation of huge amounts from the se_ and 
alike functions, but I guess it's caused by the unreliable amount of 
current free memory.

I couldn't get a good clue at which point Win32 writes out memory to the 
swapfile, making predictions about the free memory very difficult.

I could check in the code #ifdef'ed, so others can have a look and 
probably find a better way than I did ...

Regards, ULFL