Wireshark-dev: Re: [Wireshark-dev] Tshark0994 memory question

From: rmkml <rmkml@xxxxxxx>
Date: Sat, 20 Jan 2007 19:12:15 +0100 (CET)
Hi,
Im switched to wireshark 0.99.5pre1, and same memory pb,
Regards
Rmkml



On Sun, 14 Jan 2007, Guy Harris wrote:

Date: Sun, 14 Jan 2007 02:08:18 -0800
From: Guy Harris <guy@xxxxxxxxxxxx>
Reply-To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-dev] Tshark0994 memory question

rmkml wrote:
thx again for reply Guy,

You can, of course, just run with "-o tcp.desegment_tcp_streams:false" to disable TCP reassembly entirely....

tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false
and tshark use more than 500Mo!
if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo,
why ?

Good question.

I don't see that, however:

UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME COMMAND XXX 26205 7110 0 31 0 267796 93624 - S+ p6 2:27.13 tshark -ta -i en1 host mirror.cs.wisc.edu XXX 26223 7110 0 31 0 233036 27500 - S+ p6 0:22.83 tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host XXX 26229 7110 0 31 0 150152 19728 - S+ p6 0:00.60 tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host

where the first of those is after a download of an ISO from mirror.cs.wisc.edu with reassembly on, the second is after a download with reassembly off, and the latter is after TShark was started with no traffic whatsoever.

The *added* virtual memory with reassembly on is 117.644 MB, and the *added* virtual memory with reassembly off is 82.884 MB. The ISO is 108 MB, but there's only 34.760 MB more memory consumed with reassembly on. I'll look at running the "leaks" program with MallocStackLogging on, to see where the memory's going.
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev