Wireshark-dev: Re: [Wireshark-dev] regarding memory failure in wireshark

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 14 Nov 2008 10:52:28 -0500


Sake Blok wrote:

A second option is to use more then one capture
files in a ring buffer fashion limiting each file's size to a reasonable
(for your system) length. This could be easily configured in Wiresharks
capture start dialog.

Unfortunately wireshark will not flush state information when starting
to write to a new file. This means that you will still run out-of-memory
in the end.

Hmmm? I was pretty sure Wireshark did free just about everything when closing the capture file. Or am I mistaken?