Wireshark · Wireshark-dev: Re: [Wireshark-dev] PDML export on big capture files

["Edouard Funke" <korlaz@xxxxxxxxx>]

The same issue happens with "normal" tcp trafic without any custom
plugin activated.
How can i deactivate reassembly in this case ? How different would be
my output ?

On Fri, Feb 29, 2008 at 11:19 AM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> Edouard Funke wrote:
>  > The exact command i am using is :
>  > tshark -r my_big_capture_file -T pdml -V | myprogram
>  >
>  > It is tshark who is running out of memory (monitored). Could the pipe
>  > have something to do with it ?
>
>  No - TShark has no idea that its standard output is being piped to
>  another program (that's what pipes are all about - being able to take
>  output of one program and, rather than looking at it yourself or saving
>  it to a file, feeding it to another program).
>
>  It's probably a reassembly issue; particular protocols might offer an
>  option to disable reassembly, but, as per my earlier mail, you'd get
>  different output if you did that.
>
>
> _______________________________________________
>  Wireshark-dev mailing list
>  Wireshark-dev@xxxxxxxxxxxxx
>  http://www.wireshark.org/mailman/listinfo/wireshark-dev
>