>
> per Harald Tveit Alvestrand:
>
> > Is it a known bug that Ethereal 0.8.12 leaks memory?
> >
> > I discovered it while wondering why Ethereal was so slow after capturing
> > packets continuously for 3 days on a 486/66 with 40 Mbytes of
> > memory.....call me weird, but I like watching.
> > The program size was 40 Mbytes, resident 17 Mbytes; just after start,
the
> > program size was 5.9 Mbytes (as reported by ps -aux).
>
> per Fred Reimer
> I'm not sure I understand you. It was my understanding that the process
> size SHOULD grow while it captures traffic. Doesn't it keep all the
> captured packets in memory? How could it stay the same size if it did
keep
> them in memory? You'd have to pre-allocate huge amounts of memory that
you
> may not even use, as you could just be loading up Ethereal to load in a
five
> packet capture someone sent you. I think this is normal behavior.
I don't believe that the program holds the packets in memory, just the
data structures for the packet list, per packet information, and
conversations.
There may be more that I don't know about.
This is something that we should think about long term. I run our sniffers
for days on end trying to capture traffic involved with a problem and
examine
the traffic after the problem has occurred. The NAI sniffers do a nice job
of
keeping a packet buffer of the last XXX packet. I would like to see some
kind
of circular buffer that would do this in ethereal. Before I get flamed, I
know this will be difficult.
While I'm wishing. How about trigger functionality that would start or stop
a trace when the match is found.
Jeff Foster
jfoste@xxxxxxxxxxxx