Yes,
mainly memory.
ethereal is stateful and state builds up during dissection.
when the state buildup causes the working set to be equal to or larger
than available ram your system will start trashing.
trashing is bad and ususally means a kernel panic or forcing the user
to powercycle the machine.
i think you will find on average (in my experience) you need as much
ram availabel as the size of teh capture file you analyze.
On 4/15/05, harshas <harshas@xxxxxxxxxxxxxxxxxxx> wrote:
> Hello Sir,
> Please tell me Is there any limitation on size of the captured file we
> are opening in ethereal?
> Regards
> Harsha
>
> ----- Original Message -----
> From: "Guy Harris" <gharris@xxxxxxxxx>
> To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
> Sent: Friday, January 28, 2005 4:55 PM
> Subject: Re: [Ethereal-dev] Regarding Memory allocation
>
>
> > harshas wrote:
> >
> > > If the number of messages in the file is more(say more than 1000) than
> > > ethereal
> > > exits with seg fault.(I am using LINUX machine).
> > > 1. I feel LINUX machine somewhere fails to allocate such an ammount of
> > > memory to the process in which ethereal is runing? is it so?
> >
> > I suppose it's possble, but I've read captures with *many* more packets
> > than 1000.
> >
> > > 2. Do you feel it is the problem with my code?(It works upto 500
> messages).
> >
> > It's possible that there's a bug somewhere in your code (and it's
> > possible that the bug has nothing to do with the number of packets in
> > your capture). Try running it under gdb and see what the stack trace is
> > when it crashes with the segmentation fault.
> >
> > > 3. Sir I want to know why reassembly is done
> >
> > So that a packet that's fragmented across more than one link-layer
> > packet (IP fragmentation, splitting a packet across two or more TCP
> > segments, etc.) can be fully dissected.
> >
> > > and what happens during reassembling.?
> >
> > The data from all of the fragments is collected and combined into a
> > buffer in memory and saved. When dissecting the last link-layer packet,
> > a new tvbuff is constructed that refers to the reassembled data, and
> > that's what's used to dissect the higher-level packet of which the
> > link-layer packet is the last component.
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
