Hi,
Im switched to wireshark 0.99.5pre1, and same memory pb,
Regards
Rmkml
On Sun, 14 Jan 2007, Guy Harris wrote:
Date: Sun, 14 Jan 2007 02:08:18 -0800
From: Guy Harris <guy@xxxxxxxxxxxx>
Reply-To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Tshark0994 memory question
rmkml wrote:
thx again for reply Guy,
You can, of course, just run with "-o tcp.desegment_tcp_streams:false"
to disable TCP reassembly entirely....
tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false
and tshark use more than 500Mo!
if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo,
why ?
Good question.
I don't see that, however:
UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME
COMMAND
XXX 26205 7110 0 31 0 267796 93624 - S+ p6 2:27.13
tshark -ta -i en1 host mirror.cs.wisc.edu
XXX 26223 7110 0 31 0 233036 27500 - S+ p6 0:22.83
tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host
XXX 26229 7110 0 31 0 150152 19728 - S+ p6 0:00.60
tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host
where the first of those is after a download of an ISO from
mirror.cs.wisc.edu with reassembly on, the second is after a download
with reassembly off, and the latter is after TShark was started with no
traffic whatsoever.
The *added* virtual memory with reassembly on is 117.644 MB, and the
*added* virtual memory with reassembly off is 82.884 MB. The ISO is 108
MB, but there's only 34.760 MB more memory consumed with reassembly on.
I'll look at running the "leaks" program with MallocStackLogging on,
to see where the memory's going.
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev
