David Seares wrote:
Hi,
Probably a stupid question about dumpcaps memory usage.
I am trying to capture packets over a long period of time, splitting
captures over multiple files each 5 minutes.
I noticed that after just 12 hours of capturing the memory usage (vmem) of
dumpcap had reached 8GB.
Is this expected?
Assuming that this value is going up this would surely crash my computer in
the end.
One thing to note is that I am capturing IEEE802.11 traffic using the
unencryption feature of the packet dissector, could this cause this sort of
memory usage?
I wouldn't have expected dumpcap memory usage to grow very much over
time as packets are captured. If it does that sounds like a bug.
However, I'm a little confused:
You indicate that dumpcap memory usage is growing but you then say
you're "using the unencryption feature of the packet dissector"
which is not in dumpcap but is in wireshark/tshark.
Wireshark/tshark memory will increase as a function of the number of
packets dissected. That's the nature of the beast.