rmkml wrote:
thx again for reply Guy,
You can, of course, just run with "-o tcp.desegment_tcp_streams:false"
to disable TCP reassembly entirely....
tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false
and tshark use more than 500Mo!
if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo,
why ?
Good question.
I don't see that, however:
UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME
COMMAND
XXX 26205 7110 0 31 0 267796 93624 - S+ p6 2:27.13
tshark -ta -i en1 host mirror.cs.wisc.edu
XXX 26223 7110 0 31 0 233036 27500 - S+ p6 0:22.83
tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host
XXX 26229 7110 0 31 0 150152 19728 - S+ p6 0:00.60
tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host
where the first of those is after a download of an ISO from
mirror.cs.wisc.edu with reassembly on, the second is after a download
with reassembly off, and the latter is after TShark was started with no
traffic whatsoever.
The *added* virtual memory with reassembly on is 117.644 MB, and the
*added* virtual memory with reassembly off is 82.884 MB. The ISO is 108
MB, but there's only 34.760 MB more memory consumed with reassembly on.
I'll look at running the "leaks" program with MallocStackLogging on,
to see where the memory's going.