Wireshark · Wireshark-dev: Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

[Anders Broman <anders.broman@xxxxxxxxxxxx>]

Hi,
Looking more closly at the reassembly code the best solution may be to save the reasembled data
To a new temp file at the first pass and read from that file when the reassembled data is needed again.
Possibly by attaching the file offset pointer to per packet data or in the reassembled hash table.
Ultemately it would be nice to store this data in the libpcap file and have it available the next time the file
Is opened.

Does any one see any problems with having a temp file with reassembled PDU:s? I suppose this file can become
Almost as big as the original trace file.

Regards
Anders