On Wednesday, June 18, 2003, at 04:22 PM, Jack Jackson wrote:
The reason I want it is to limit the size of each file. Ethereal, at
least on Win2K, seems to consume quite a bit of memory for the
protocol tree.
Unless there's some place where we fail to destroy the structure
referring to the protocol tree, and thus the protocol tree itself
(which would be a bug, but we haven't, as far as I know, had such a bug
in ages), the only protocol trees that are allocated are the ones that
are being displayed (the currently selected packet, if any, plus any
packets displayed in separate windows). Thus, Ethereal *doesn't*
consume much memory for protocol trees, on UNIX or Windows.
It *does*, however, consume a lot of memory on *all* platforms for the
packet list - and, more significantly, for the display *of* the packet
list. This may change at some point, although that needs some
infrastructure work first.
If the file is very large it will crash.
That *might* be why it's crashing with a large file (or it might be due
to memory allocated for state maintained by dissectors, or for packet
reassembly) - but it might also be that the capture is large enough
that it happens to contain packets or sequences of packets that trigger
a crash.