[Guy Harris <gharris@xxxxxxxxx>]

Gaurav Batra wrote:

> But When I do not use the option,"update list of packets in real time", 
> Virtual memory used by ethereal is minimal and there is no problem while 
> capturing for long period.

Yes, but when you stop the capture, Ethereal will try to read in the 
capture - and it'll use up as much virtual memory when reading the 
capture in as it would during an "Update list of packets in real time" 
capture (because an "Update list of packets in real time" capture is 
just a capture where the file is read in, a packet at a time, as packets 
arrive, rather than being read in all at once when the capture stops; 
the process for reading in the capture is the same).