Wireshark-dev: Re: [Wireshark-dev] Tshark0994 memory question

From: rmkml <rmkml@xxxxxxx>
Date: Sun, 14 Jan 2007 10:06:25 +0100 (CET)
thx again for reply Guy,

You can, of course, just run with "-o tcp.desegment_tcp_streams:false" to disable TCP reassembly entirely....

tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false
and tshark use more than 500Mo!
if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo,
why ?
Regards
Rmkml