Wireshark-dev: Re: [Wireshark-dev] Setting to disable all expert info
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Dario Lombardo <dario.lombardo.ml@xxxxxxxxx>
Date: Fri, 4 Aug 2017 10:49:08 +0200
On Wed, Aug 2, 2017 at 10:21 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

Let's wait until the generation of the expert info results in a measurably significant CPU or memory use increase before we add a knob to turn it off.  There are probably other places to look at to reduce memory usage first.

That's an interesting point... any idea what they are?
I worked on the conversation code that looks one of the most memory eaters. I was working on purging pending conversations after a while. The idea was that if I can't find the corresponding packet of a conversation in a bunch of seconds (let's say 5), it is very unlikely that I will find it. I am aware that some protocols could have looser timing constraints and this approach wouldn't work for them, but I was just playing with the idea. What do you think?