Ethereal-users: RE: [Ethereal-users] Memory leaks in Ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Sadin Nurkic <sadin.nurkic@xxxxxxxxx>
Date: Fri, 17 Feb 2006 10:01:51 +1100
Hi,

As raised by me a few days ago, and after re-reading this thread I'm
almost certain there have been new leaks introduced in 0.10.13 and
0.10.14.

I use tethereal with the -R option and I've used this many times
before without any issues on older versions. Right now it only works
for about 10minutes under a 10mbps stream of data before it runs out
of memory on a 2Gb RAM machine that runs pretty much nothing else.

I've read the wiki for "outofmemory" and "performance" and tried the
suggestions, but I never had reassembly or defragmentation turned on,
so this doesn't explain this sudden surge in memory usage to me.

Could you clarify a little bit on how exactly the memory usage grows
for short lived TCP sessions? Shouldn't the memory clear once the TCP
session has cleared? I do understand that ethereal needs to keep data
in memory naturally, but I do not understand why so much memory is
used up so quickly on such a small stream. Especially as all I'm
trying to do is filter and write to a file. (as explained before I
must use the read filter as I filter on a field deep within the
tunneled packet).

Where can I find some info on how to profile the memory usage as I'm
certain that the behaviour has significantly changed in 0.10.13+?

Regards,
Sadin Nurkic


Date: Thu, 16 Feb 2006 14:11:43 +0100
From: Ulf Lamping <ulf.lamping@xxxxxx>
Subject: RE: [Ethereal-users] Memory leaks in Ethereal
To: Ethereal user support <ethereal-users@xxxxxxxxxxxx>
Message-ID: <680749524@xxxxxx>
Content-Type: text/plain; charset=iso-8859-15


Ethereal user support <ethereal-users@xxxxxxxxxxxx> schrieb am
16.02.06 12:58:43:
>
> With this configuration I was able to capture 7,500,000 packets. This means
> probably there are memory leaks in Ethereal.
>

These are no memory leaks!

Ethereal needs to keep information of the previous packets in order to
dissect the next packets correctly.

See the mentioned Wiki page again, I've added a section why it's not a
memory leak.

Regards, ULFL
__________________________________________________________________________
Erweitern Sie FreeMail zu einem noch leistungsstarkeren E-Mail-Postfach!
Mehr Infos unter http://freemail.web.de/home/landingpad/?mc=021131