Libpcap 0.8.3
tethereal install only (no gui) 0.10.7
Slackware 10
Linux nmsdev 2.4.26 #6 Mon Jun 14 19:07:27 PDT 2004 i686 unknown
unknown GNU/Linux
# uname -a
Linux nmsdev 2.4.26 #6 Mon Jun 14 19:07:27 PDT 2004 i686 unknown
unknown GNU/Linux
The system has 512MB ram, and I have turned off swap. It does not run
X (at the moment) so it's memory consumption is small ... ~ 100MB.
For some reason or another, tethereal kicks the bucket after some time
capturing. It's not always the same length of time, nor is it after
the capture file is a certain size. I notice that as tethereal runs
it eats ram constantly; does this not seem strange behavior as it is
writing it to a file?
# tethereal -i eth0 -R "ip.addr == 10.1.1/24" -w /home/data1/ADcapture5.cap -q
Warning: Couldn't obtain netmask info (eth0: no IPv4 address assigned).
Capturing on eth0
Killed
Some log excerpts:
/var/log/messages:
Nov 29 12:32:47 nmsdev kernel: device eth0 entered promiscuous mode
Nov 29 12:45:18 nmsdev kernel: __alloc_pages: 0-order allocation
failed (gfp=0x1d2/0)
Nov 29 12:45:18 nmsdev kernel: device eth0 left promiscuous mode
/var/log/syslog:
Nov 29 12:45:18 nmsdev kernel: VM: killing process tethereal
Would it be helpful if I attach the capture file? Here I replay it tcpdump:
# tcpdump -r ADcapture5.cap
...
... (lots of capture data)
...
tcpdump: pcap_loop: truncated dump file; tried to read 64 captured
bytes, only got 1
Thanks,
Paul