On Wed, Nov 03, 2010 at 03:00:10PM -0400, Jeff Morriss wrote:
> Memory mapped files count as part of the process' address space so
> mapping the capture file means that, for reassembly, we'd be trading
> malloc'd memory for mmap()'d memory *and* it would mean we're holding
> the whole file--including the bits not used in reassembly--in memory.
> (We don't currently do this.)
Well I'm not expert in mmap()'ed files, but afair they won't be read until page fault,
and madvise(..., MADV_DONTNEED) should free memory.
Still it's lot easier to work with than fread() + fseek()
> Memory-mapped files also are problematic when doing live captures: as
> the file grows we'd have to remap the memory (yikes!)
Ok, I agree this is problem. But why yikes?