Wireshark · Wireshark-dev: Re: [Wireshark-dev] dumpcap memory usage during 802.11 capture

[Bill Meier <wmeier@xxxxxxxxxxx>]

David Seares wrote:
> Hi,
>
> Probably a stupid question about dumpcaps memory usage.
>
> I am trying to capture packets over a long period of time, splitting
> captures over multiple files each 5 minutes.
>
> I noticed that after just 12 hours of capturing the memory usage (vmem) of
> dumpcap had reached 8GB.
>
> Is this expected?
>
> Assuming that this value is going up this would surely crash my computer in
> the end.
>
> One thing to note is that I am capturing IEEE802.11 traffic using the
> unencryption feature of the packet dissector, could this cause this sort of
> memory usage?

I wouldn't have expected dumpcap memory usage to grow very much over 
time as packets are captured. If it does that sounds like a bug.

However, I'm a little confused:

You indicate that dumpcap memory usage is growing but you then say 
you're "using the unencryption feature of the packet dissector"
which is not in dumpcap but is in wireshark/tshark.

Wireshark/tshark memory will increase as a function of the number of 
packets dissected. That's the nature of the beast.