Wireshark · Wireshark-dev: Re: [Wireshark-dev] dumpcap memory usage during 802.11 capture

[Bill Meier <wmeier@xxxxxxxxxxx>]

David S wrote:
> Bill Meier <wmeier@...> writes:
> > I wouldn't have expected dumpcap memory usage to grow very much over 
> > time as packets are captured. If it does that sounds like a bug.
> >
> > However, I'm a little confused:
> >
> > You indicate that dumpcap memory usage is growing but you then say 
> > you're "using the unencryption feature of the packet dissector"
> > which is not in dumpcap but is in wireshark/tshark.
> >
> > Wireshark/tshark memory will increase as a function of the number of 
> > packets dissected. That's the nature of the beast.
> >
> > ___________________________________________________________________________
> > Sent via:    Wireshark-dev mailing list <wireshark-dev@...>
> > Archives:    http://www.wireshark.org/lists/wireshark-dev
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> >              mailto:wireshark-dev-request@...?subject=unsubscribe
>
> Ok, I'll run it again and see if I observe the same behaviour.  It was 
> definitely dumpcap which had high memory and cpu usage.
>
> Sorry, I mis-understood what was going on with the dissectors, I thought that 
> if I ran the capture through Wireshark the captures would be decoded, I was 
> wrong as the raw packets were output to file (obviously).

I should have been clearer in my original rely.

Wireshark runs dumpcap to do the actual capture. Dumpcap writes to a 
file and Wireshark reads from the file.

So: When running a cature through Wireshark, the catures are decoded (by 
Wireshark).