Wireshark · Wireshark-dev: Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 3, 2010, at 2:48 PM, Jeff Morriss wrote:

Jakub Zawadzki wrote:

Well I'm not expert in mmap()'ed files, but afair they won't be read until page fault,

They may not be loaded into memory, but AFAIK the mapped memory will
immediately count towards the process' (used) address space.

Correct.  Every time you successfully call mmap() (or MapViewOfFile(), on Windows), a kitten dies, err, sorry, a region of your address space becomes unavailable for other purposes.

and madvise(..., MADV_DONTNEED) should free memory.

Never heard of that until now; interesting...  But DONTNEED just says "I
won't need it soon" (so feel free to page it out--but that won't reduce
our used address space).

Correct.  madvise(..., MADV_DONTNEED) (and, if there is one, the Windows equivalent) may reduce physical memory pressure by telling the system to feel free to grab that page for other purposes, but it has no effect whatsoever on your virtual address space.

REMOVE would mean "unmap the memory" but the 

Linux man page says that only works with shmfs/tmpfs--and anyway we will
probably need it again.  And I'm guessing it's not portable (the Linux
man page makes a reference to Posix 2001).

"man madvise" on my machine doesn't mention an MADV_REMOVE, so, no, it's not portable.