Wireshark · Ethereal-dev: Re: [Ethereal-dev] packet-smb.c:11327 - si->info_level = t2i->info_level

["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

From: "Marcin Gryszkalis"
To: "Ronnie Sahlberg"
Sent: Wednesday, February 20, 2002 11:15 PM
Subject: Re: [Ethereal-dev] packet-smb.c:11327 - si->info_level =
t2i->info_level


> Ronnie Sahlberg wrote:
> > This should make the request reply matching more correct since this
patch
> > also checks the
> > cmd to see if they are compatible.
> >
> > Marcin, can you try to apply this patch and see if it fixes your
problem?
> I just sent replay before getting this patch.
> Is this patch commited to the sources (I could get it via cvs)?

No it is not yet in CVS. I dont currently have CVS write access so I cant
check it in myself.
When you download the latest CVS, just check wether Guy has checked it in
for me or else
you can just apply the patch yourself. The patch is really small.

>
> Another thing is that this happened just once (and tethereal is working
> 24h/day) so it's not frequent/constant behavior.

You run tethereal for very very very long captures? Like millions of
packets?
As i stated earlier,
tethereal is stateful, i.e. in order to dissect quite a lot of different
protocols it must remember stuff between packets.
This will cause [t]ethereal to allocate more and more memory on your box
until your OS thiks "enough is enough" and it will
kill tethereal (or panic, if it is a suboptimal os).

For 24/7 monitoring of data I would usually run tethereal to capture only a
certain maximum number of packets and then terminate and restart.
Something like :

while [true]; do
    capture-1-milion-packets-with-tethereal-to-file
    rotate-catpture-files
done

This would allow you to restart tethereal say once every 1 or 10 milion
packets which would return all allocated memory back to the OS
and allow tethereal to start fresh again.



>
>
>
>
> --
> Marcin Gryszkalis <mg@xxxxxxxxx>
> or <dagoon@xxxxxxxxxxxxxxxx>
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev