At 09:15 13/10/2000 -0400, Reimer, Fred wrote:
I'm not sure I understand you. It was my understanding that the process
size SHOULD grow while it captures traffic. Doesn't it keep all the
captured packets in memory? How could it stay the same size if it did keep
them in memory? You'd have to pre-allocate huge amounts of memory that you
may not even use, as you could just be loading up Ethereal to load in a five
packet capture someone sent you. I think this is normal behavior.
hmmm....I may have observed a normal behaviour.
Just now my packet count passed 97.000, the newest /tmp/etherXXXX file was
28 Mbytes, and the ethereal size was 37 Mbytes, having grown by 31 Mbytes
since startup.
This works out to 320 bytes per packet on average, which isn't very much if
you have this continuously growing packet list in there.
What I thought would happen when doing a real time capture without a file
and without an upper limit was that packet descriptions would go to some
kind of ring buffer structure, limiting your scrollback to the last few
thousand or so packets (hard to navigate using a scrollbar when you have >>
thousands of lines, anyway).
But since it isn't that way, I guess I'll just live with that.
Thanks for the product - it looks powerful, and beautiful!
Harald