Wireshark · Wireshark-dev: Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

[Jakub Zawadzki <darkjames@xxxxxxxxxxxxxxxx>]

Hi,

On Wed, Nov 03, 2010 at 04:24:21PM +0100, Anders Broman wrote:
> Looking more closly at the reassembly code the best solution may be to save the reasembled data
> To a new temp file at the first pass and read from that file when the reassembled data is needed again.
> Possibly by attaching the file offset pointer to per packet data or in the reassembled hash table.
> Ultemately it would be nice to store this data in the libpcap file and have it available the next time the file
> Is opened.
> 
> Does any one see any problems with having a temp file with reassembled PDU:s? I suppose this file can become
> Almost as big as the original trace file.

Temp files are also kind of memory, so you won't decrease memory by using them :>
Btw. it's like reinventing swap, so if you want to use your disk as memory,
it's enough to create some big file and do mkswap & swapon.
(Well maybe on 32-bit systems it's not so easy...)

I like Jeff Moriss idea about mmap()ed files.