Wireshark · Wireshark-dev: Re: [Wireshark-dev] New packet list - out of memory?

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Anders Broman wrote:
> > Should we have a new allocator without the canaries?
> I think either the current se_ allocations implementation need to be changed
> Or the function removed. The result where WIRESHARK_DEBUG_SE_NO_CHUNKS=T
> And loading is faster is puzzling.

Trying that on Linux (64-bit) with a capture file of mine, I get (all 
with SVN 30347, new packet list):

(no env settings)
CPU time ("user time" from 'times'): 40.491 seconds
VSZ (from ps aux): 995,644

With WIRESHARK_DEBUG_SE_NO_CHUNKS set:
CPU time: 43.048 seconds
VSZ: 1,128,076

With WIRESHARK_DEBUG_EP_NO_CHUNKS and WIRESHARK_DEBUG_SE_NO_CHUNKS set:
CPU time: 48.536 seconds
VSZ: 1,120,308


(It's a bit odd that memory usage goes up when chunks are off.)

Maybe Windows doesn't like big (10Mb) allocations?  Another thing is 
that turning off chunks also turns off canaries.  Don't know why that 
would make a difference in loading time.  I can't imagine generating a 
few random numbers for each chunk would be that expensive.