[Ambarisha B <b.ambarisha@xxxxxxxxx>]

On Thu, Apr 18, 2013 at 9:25 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:

  The real problem (which I thought file-backed-tvbuffs might solve) would be when dissectors have to make copies of tvbuffs in order to do, for example, reassembly.  Those copies are malloc()'d and it is believed that, in some situations, they account for a lot of Wireshark's memory usage.

Yeah, you did suggest the idea in that context first. Guy also mentioned a couple of times that the reassembly is retained in wireshark's address space. I just used the views as a lead to get into the code first time.

 

I doubt there's much in the way of a bug to look at; I think to get your hands dirty you'd have to start digging into how, for example, the tvbuffs and reassembly work and see if it can be put together.

Indeed, I was going through the reassembly code only today. I'll also see if I can get a profile from massif as Evan suggested. 

Cheers

Ambarish