Wireshark-dev: Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for r
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Wed, 03 Nov 2010 17:51:16 -0400
Anders Broman wrote:

Jakub Zawadzki skrev 2010-11-03 20:48:

On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote:

I like Jeff Moriss idea about mmap()ed files.

...which consume address space, so, again, if the problem is running out of address space,
rather than running out of main memory+backing store for anonymous pages, that won't help.

Ok, but what is MAIN problem? That wireshark run out of address space or oom?

Still reimplementing reasamble.c (list structure) with single file (linear) is
imho hard thing to do.
My naive idea was on the first pas to once reassemble.c reassembled the packet and handed the tvb to the caller save the reassembled buffer to file and save the file offset then release the memory holding the data. If the packet then needs to be redsplayed or filtered that data would be read in from file and stuffed into the tvb returned to the caller. But in light of the recent mails perhaps not so useful. Better to get 64 bit machines 

Still sounds useful to me...  Though maybe not very easy.
I really have been hoping for a way to hide the file stuff behind, for example, TVBs, but I haven't had much time to think about it.