Wireshark-dev: [Wireshark-dev] Growing memory with tshark & Lua

From: Thomas Baudelet <thomas.baudelet@xxxxxxxxx>
Date: Mon, 9 Nov 2020 17:41:37 +0100
Hi Devs,

When Wireshark profiles are correctly tuned (few protocols, disabled TCP reassembly & analysis, bytes tracking, timestamps calculations, IP defrag), tshark memory doesn't grow at all.

Simply adding a simple Lua script with 1 listener and 1 field, without doing nothing with them, then the memory grows along with pcap file.

As tshark memory alone doesn't grow due to correct profile, I'd have expected Lua to forget about all values also on each Listener.packet() loop, but it doesn't seem to be coded like this.

Lua script by itself doesn't consume that much memory according to collectgarbage("count").

So it seems that Lua+Listener+Field is forcing { tshark / Lua } to collect all packets as if some reassembly was asked.

Anybody has some hints about this, the section of code involved here ?

And most important : is there a way to prevent the memory growing !

Thanks,
Thomas