On Tue, Mar 29, 2011 at 11:07:14AM -0400, Jeff Morriss wrote:
> Jakub Zawadzki wrote:
> > Isn't reassemble.c API good (and working!) replacement for composite TVBs?
>
> It works, but it uses memory.
Ok, but tvb_* won't work with not contiguous memory, and composite doesn't have proper fix for it either ;/
I'm drinking to:
tvb->real_data = tvb_memdup(tvb, 0, -1);
inside composite_ensure_contiguous_no_exception()
read: if you try to read data which is from two tvbs (which should occur quite common, cause we want to treat it like data from one packet)
it will alocate memory like reasemble do.
> I still have high hopes (maybe just dreams?) of doing something to lower
> Wireshark's memory usage, and composite TVBs might play a part.
It's ok to have dreams, worse if they will become nightmares ;)
Maybe some garbage collector? :)
Crazy idea:
Last time when we talk about reasemble memory [1] idea about mmap()
was ok but not (mainly) for 32.
So what you think about creating some process just to handle tvb data?
For IPC we could use shared memory API Like shm_* on POSIX.
When nightmares become real... ;)
[1] http://seclists.org/wireshark/2010/Nov/55