Wireshark · Wireshark-dev: Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

[Anders Broman <a.broman@xxxxxxxxx>]

Jakub Zawadzki skrev 2010-11-03 20:48:
> On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote:
> > > I like Jeff Moriss idea about mmap()ed files.
> > ...which consume address space, so, again, if the problem is running out of address space,
> > rather than running out of main memory+backing store for anonymous pages, that won't help.
> Ok, but what is MAIN problem? That wireshark run out of address space or oom?
>
> Still reimplementing reasamble.c (list structure) with single file (linear) is
> imho hard thing to do.
My naive idea was on the first pas to once reassemble.c reassembled the 
packet and handed the tvb to the caller
save the reassembled buffer to file and save the file offset then 
release the memory holding the data. If
the packet then needs to be redsplayed or filtered that data would be 
read in from file and stuffed into the
tvb returned to the caller. But in light of the recent mails perhaps not 
so useful. Better to get 64 bit machines
with lots of memory :-))
At work all sniffer boxes are 64bits any way.
Regards
Andes

> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list<wireshark-dev@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>               mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe