Wireshark-dev: Re: [Wireshark-dev] 8Gig for Win64 WireShark?
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 28 Apr 2009 10:17:07 -0700

On Apr 28, 2009, at 10:10 AM, Brian Daniel wrote:

I want to take max advantage of my quad processor and RAM. Will the Windows-XP-Win64 build of WireShark take advantage of the additional RAM if I upgrade my Windows Vista 64-bit from 4Gig RAM to 8Gig RAM?

A 64-bit version of Wireshark will be able to have more than 4GB of data in its address space if you have enough RAM (and possibly even if you don't, if you have enough backing store - paging files and/or paging partitions - although that means it could be paging stuff into and out of main memory a lot). Wireshark will do so only if you try to read in a file large enough to require it.

A 32-bit or 64-bit version of Wireshark will, on a machine with more than 4GB of RAM and an operating system that supports that RAM as general paging memory (rather than the specialized support offered by 32-bit versions of Windows), be able to, even if it doesn't have more than 4GB of data in its address space, share that memory with more programs or bigger programs, so, *if* you're running other stuff that could compete with Wireshark for memory, and that competition is happening and slowing Wireshark (and the other stuff) down, even a 32- bit version of Wireshark could work better if you add more memory.