Wireshark-users: Re: [Wireshark-users] OutOfMemory

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 22 Apr 2010 16:14:20 -0400
Wynns, Roger [OXFORD] wrote:
Gentlemen,

Actually, I'm pretty sure there are some ladies on the list too :-)

I was trying to open a 200MB .pcap file into Wireshark(1.2.2) under
Ubuntu(see System Monitor.png) and I got the OutOfMemory message.
According to the System Monitor, I was not out of memory(see
OutOfMemory.png).  I have read the Wiki page and it said that it would use
all available memory/swap space.

Is there some setting that I need to set to force it to use all memory
and/or swap space?

Any other reason that it is not using all the memory?

How much memory was Wireshark using when it died? Is it a 32- or 64-bit executable? (If you're not sure, run 'file' on the Wireshark executable, e.g., "file /usr/bin/wireshark".)

32-bit processes will be limited to 4 Gbytes of memory. I'll look to see if that can be mentioned somewhere on the OutOfMemory wiki page.