Wireshark-bugs: [Wireshark-bugs] [Bug 2343] New: Huge increase in Wireshark runtime memory foot

Date: Sun, 9 Mar 2008 16:50:29 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2343

           Summary: Huge increase in Wireshark runtime memory foot print for
                    recent win32 SVN buildbot images
           Product: Wireshark
           Version: SVN
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: jyoung@xxxxxxx


Build Information:
Version 0.99.9-SVN-24587 (SVN Rev 24587)

Copyright 1998-2008 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.12.8, with GLib 2.14.6, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.5,
with ADNS, with Lua 5.1, with GnuTLS 1.6.1, with Gcrypt 1.2.3, with MIT
Kerberos, with PortAudio V19-devel, with AirPcap.

Running on Windows XP Service Pack 1, build 2600, with WinPcap version 4.0.2
(packet.dll version 4.0.0.1040), based on libpcap version 0.9.5, without
AirPcap.

Built using Microsoft Visual C++ 6.0 build 8804

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.


--
Hello,

It looks like recent win32 buildbot images use dramatically more runtime 
memory if and when one opens a trace file.

I have a trace file that has 121794 frames (size ~31,202 KB).

If I open this trace file using the stock win32 Wireshark 0.99.8 
release, the Microsoft Windows' Task Manager "PF Usage" implies that 
Wireshark has used 124 MB of memory. 51 MB is consumed when Wireshark 
itself is simply started; when the trace file is opened another 73 MB 
is consumed.  

If I open this same trace file using a recent win32 buildbot version
e.g. 0.99.9-SVN-24587 (SVN Rev 24587), the Windows Task Manager 
"PF Usage" implies that Wireshark has used 923 MB of memory! 53 MB
is consumed when Wireshark itself is simply started; when the trace 
file is opened another 876 MB is consumed.

Runtime memory requirements are even worse is if I enable the custom 
columns feature.  When I created a custom column of "ip.version", 
the runtime memory usage increased such that Wireshark now consumed 
1049 MB of memory for the same trace file. 54 MB is consumed when 
Wireshark itself is opened; when the trace file is opened another 
995 MB is consumed!

Question:  Why does a trace file of ~31 MB that previously consumed
73 MB of runtime memory now consume 876 MB of runtime memory (or
995 MB if a custom column is enabled)?

FWIW:  The trace file I am using contains 121794 frames. 77754 of 
these frames match the display filter of "icmp", the other 64040 
match the filter "!icmp".   These "!icmp" frames are bootp (actually 
dhcp) frames (both requests and replies).  Of the "icmp" frames
about 32805 actually match a "bootp" display filter because these
are "Destination unreachable (port Unreachable)" frames erroneously 
generated by the system that is hosting the DHCP daemon.  
Interestingly/oddly the DHCP is successfully responding to the 
DCHP requests, while the host system is generating the icmp error
messages!  It is doubtful that the specific makeup of this trace file 
(other than the number of frames) is having any real bearing on the 
memory consumption of Wireshark.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.