Hi,
As it is right now mate too would allolcate memory for every for every
item it creates not freeing most of it until reinitialized. I thought
for mate (since the very begining) that it should be keeping just a
window of what it has seen (the last "max_items" packets). I took this
out from the code at a certain point because I was rewriting mate too
often and carrying this code significantly slowed down developement.
> This willb e a big and long term project, if it is started and it
> wouldr eqwuire someone (not me) to use valgrind or something similar
> to track these users down one by one.
>
The "delete old items" feature should be used only by tethereal (I
expect an user to want everything about a capture file when using it
interactively). How can mate, or any other dissector, know whether it
is running under tethereal or ethereal?
> It would be much easier to just do what i do :
> just write a small shellscript that runs an infinite loop running
> tethereal or tcpdump and capturing 1 milion packets in each run.
> Generate filenames for the captures based on
> the timestamp when the capture was started.
This approach allows for many other things:
- using tcpdump to capture, (which especially at high loads is far
more reliable than tethereal)
- using mergecap to join the captures of variuos interfaces
- having more instances of tethereal doing its job (using more
processors if available)
But for mate this creates a hole, the new tethereal instance would
start not knowing anything about sessions already initiated so mate
would not be able to relate stuff from the old instance.
Would it be worth telling mate to dump its current state in a temp
file so that the new instance can load it into memory at the
successive runs?
Luis