Wireshark-users: Re: [Wireshark-users] tshark memory
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 19 Jan 2010 12:35:04 -0800
On Jan 19, 2010, at 12:26 PM, Abhijit Bare wrote:

> I have a problem with tshark memory usage. I need to use tshark for a read filter. However, it looks like tshark reads in the entire input file in memory. Is this correct?

No, it is not.  Neither Wireshark nor TShark read the entire input file into memory.

When it reassembles fragmented/segmented/etc. packets, however, the content of the reassembled packets *is* kept in memory.