Wireshark-bugs: [Wireshark-bugs] [Bug 7676] tshark -q -z io, stat, 1 causes core dump for files
Date: Tue, 4 Sep 2012 10:39:13 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7676 --- Comment #7 from Steve Magnuson <steve.magnuson2@xxxxxxxxxx> 2012-09-04 10:39:12 PDT --- (In reply to comment #6) [snip] > Thanks for uploading it, still I can't reproduce the problem. > On my Linux/AMD64 tshark (r44719) use *only* 307 MB: > $ /usr/bin/time -v ./tshark -n -r /tmp/20120214-BA_00001_20120214155239.pcap -q > -z io,stat,1 > /dev/null > [...] > Maximum resident set size (kbytes): 307264 > [...] > I really don't know why your tshark takes almost 3GB, any custom plugins? > dissectors? Special configuration? > Can you test if older version of tshark (1.6.x, 1.4.x) has the same problem? > What's memory usage without stats? (i.e. tshark -n -r > 20120214-BA_00001_20120214155239.pcap -q) I have no special dissectors or plugins - it's a generic installation. It works fine (same parameters and trace file) on 1.4.6 and 1.6.10 on this OS. It fails under 1.8.1 and 1.8.2. Here's the memory footprint for the successful run on 1.6.10: PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND 46024 steve 1 73 0 91396K 51144K RUN 0:01 0.00% tshark [steve@wan231s1 ~]$ /usr/local/src/wireshark-1.6.10/tshark -v TShark 1.6.10 (SVN Rev Unknown from unknown) Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled (32-bit) with GLib 2.28.8, with libpcap (version unknown), with libz 1.2.5, without POSIX capabilities, without libpcre, with SMI 0.4.8, without c-ares, with ADNS, without Lua, without Python, with GnuTLS 2.12.18, with Gcrypt 1.5.0, with Heimdal Kerberos, with GeoIP. Running on FreeBSD 9.0-RELEASE-p3, with libpcap version 1.3.0, with libz 1.2.5. Built using gcc 4.2.1 20070831 patched [FreeBSD]. ======================= Memory usage on 1.8.2 *without* "-z io,stat,1" (which works fine): PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32522 steve 1 22 0 70952K 30280K CPU1 1 0:00 0.59% tshark ======================= Also, I ran the tshark 1.8.2 with a 10 second io,stat interval rather than 1 second (tshark -n -r 20120214-BA_00001_20120214155239.pcap -q -z io,stat,10) and the memory footprint is much smaller, but it still coredumps: PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 76 0 917M 877M CPU0 0 0:02 16.26% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 79 0 1553M 1515M CPU0 0 0:03 24.46% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 81 0 2193M 2153M CPU0 0 0:04 31.98% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 83 0 2717M 2672M RUN 0 0:05 34.47% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2809M 2765M RUN 1 0:05 32.67% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 81 0 2809M 2767M RUN 1 0:05 29.69% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2870M wdrain 0 0:05 30.37% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2863M wdrain 1 0:05 30.37% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2721M wdrain 1 0:06 30.66% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2730M swread 0 0:06 29.30% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2752M RUN 1 0:06 27.88% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2752M swread 1 0:06 27.10% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 49 0 2933M 2772M swread 1 0:06 26.37% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 49 0 2933M 2767M wdrain 0 0:07 28.17% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 81 0 2933M 2767M RUN 0 0:07 31.88% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2933M 2767M CPU0 0 0:08 34.67% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2933M 2767M CPU1 1 0:08 32.67% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2933M 2767M CPU0 0 0:09 33.15% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2767M wdrain 1 0:09 36.08% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2933M 2767M CPU0 0 0:09 34.38% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 82 0 2933M 2767M CPU0 0 0:10 34.38% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2767M wdrain 1 0:10 38.48% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 83 0 2933M 2767M CPU1 1 0:11 35.69% tshark PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32587 steve 1 52 0 2933M 2767M wdrain 0 0:11 37.26% tshark Regards, Steve -- Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
- Prev by Date: [Wireshark-bugs] [Bug 6527] corba dissector generator improvement
- Next by Date: [Wireshark-bugs] [Bug 2692] ged125 dissector
- Previous by thread: [Wireshark-bugs] [Bug 7676] tshark -q -z io, stat, 1 causes core dump for files larger than ~2MB
- Next by thread: [Wireshark-bugs] [Bug 7676] tshark -q -z io, stat, 1 causes core dump for files larger than ~2MB
- Index(es):