On May 25, 2010, at 11:20 AM, János Löbb wrote:
> What am I doing wrong ? After the crash top showed still 2340M free on the machine and the disk has 52GB free space. So I do not think I ran into some kind of limitation.
You'd be surprised at how much memory Wireshark can eat, unfortunately:
http://wiki.wireshark.org/KnownBugs/OutOfMemory
Note also that what matters isn't the *physical* memory, but the *virtual* memory; Wireshark is a 32-bit program, so its *total* address space is limited to 4GB, regardless of how much memory you have and how much disk space could be used for swap files. Address space could also be lost to fragmentation.
> Should I try with 1.2.8 or with a development of 1.3.x ?
I don't see any memory leak fixes between 1.2.6 and 1.2.8:
http://wiki.wireshark.org/Development/Trunk-1.2
although I might have missed something.
Fixing the memory consumption issues involves some significant changes that won't go into the bug-fix releases; the development train does have some changes that reduce memory consumption (with the old packet list widget, every single string in every single column of every single row had a copy of its string - that's the way the GTK+ widget in question works - and that could eat a significant amount of memory; with the new packet list widget, not all columns have copies made of them), so 1.3.x might be worth trying.
There are some other changes that could significantly reduce the amount of memory used, but they require some more significant changes, and won't happen for 1.3.x/1.4.x.