Wireshark-users: Re: [Wireshark-users] tshark memory

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 19 Jan 2010 13:07:15 -0800
On Jan 19, 2010, at 12:57 PM, Abhijit Bare wrote:

> After 2 hours, my tshark process is using 3.6G RESIDENT memory and ~ 500G VIRT memory in top output.

To quote my reply:

> When it reassembles fragmented/segmented/etc. packets, however, the content of the reassembled packets *is* kept in memory.

Other data structures that maintain state are also kept in memory.