[Guy Harris <guy@xxxxxxxxxx>]

> >From what I can remember Ethereal tries to allocate 
> memory until there's nothing left.

...and, as it uses a GtkClist, it allocates rather a lot of it.

If, as, and when I ever finish the GtkClist replacement, that will
improve significantly, although, obviously, if you let Ethereal run long
enough, it'll still be an issue, as it still allocates memory per
packet.

> Our idea is to set 
> a maximum to the size of the memory that can be allocated 
> and when the maximum is reached to dump it all to disk 
> and start with a new file. This way, you can have an 

Ethereal dumps every captured packet to disk anyway; are you saying that
it should close the current capture file (and discard all in-memory
information for all packets) and open a new capture file and write
subsequent packets to that file?

If so, note that, if you have a large capture, discarding all in-memory
information for all packets is currently an expensive operation for
large lists of packets, due to all the GtkClist junk it has to free.