[Dario Lombardo <dario.lombardo.ml@xxxxxxxxx>]

On Wed, Aug 2, 2017 at 10:21 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

Let's wait until the generation of the expert info results in a measurably significant CPU or memory use increase before we add a knob to turn it off.  There are probably other places to look at to reduce memory usage first.

That's an interesting point... any idea what they are?

I worked on the conversation code that looks one of the most memory eaters. I was working on purging pending conversations after a while. The idea was that if I can't find the corresponding packet of a conversation in a bunch of seconds (let's say 5), it is very unlikely that I will find it. I am aware that some protocols could have looser timing constraints and this approach wouldn't work for them, but I was just playing with the idea. What do you think?