Ethereal-dev: FW: [Ethereal-dev] Memory leak of ethereal-0.8.12

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Foster <jfoste@xxxxxxxxxxxx>
Date: Fri, 13 Oct 2000 08:43:50 -0500
>
> per Harald Tveit Alvestrand:
> 
> > Is it a known bug that Ethereal 0.8.12 leaks memory?
> > 
> > I discovered it while wondering why Ethereal was so slow after capturing

> > packets continuously for 3 days on a 486/66 with 40 Mbytes of 
> > memory.....call me weird, but I like watching.
> > The program size was 40 Mbytes, resident 17 Mbytes; just after start,
the 
> > program size was 5.9 Mbytes (as reported by ps -aux).
> 
> per Fred Reimer
> I'm not sure I understand you.  It was my understanding that the process
> size SHOULD grow while it captures traffic.  Doesn't it keep all the
> captured packets in memory?  How could it stay the same size if it did
keep
> them in memory?  You'd have to pre-allocate huge amounts of memory that
you
> may not even use, as you could just be loading up Ethereal to load in a
five
> packet capture someone sent you.  I think this is normal behavior.

I don't believe that the program holds the packets in memory, just the 
data structures for the packet list, per packet information, and
conversations.
There may be more that I don't know about.

This is something that we should think about long term.  I run our sniffers
for days on end trying to capture traffic involved with a problem and
examine
the traffic after the problem has occurred.  The NAI sniffers do a nice job
of
keeping a packet buffer of the last XXX packet.  I would like to see some
kind
of circular buffer that would do this in ethereal.  Before I get flamed, I
know this will be difficult.  

While I'm wishing.  How about trigger functionality that would start or stop
a trace when the match is found.  


Jeff Foster
jfoste@xxxxxxxxxxxx