Wireshark · Ethereal-users: [Ethereal-users] Re: Tethereal runs out of memory...

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

[t]ethereal are stateful applications, they keep information memorized
between packets. the state will build up over time which means you can
not run them for unlimited amounts of time.
The statefulness has this drawback but allows [t]ethereal to do very
advanced analysis.

What you have to do is to at regular intervals clear the state and
start from scratch.

the easiest way to do this is by running tethereal in a loop to
terminate and restart ethereal every 1 milion packets or so.


On 4/13/05, Cyber Terrorist <cybertet@xxxxxxxxx> wrote:
> Hi,
> 
> I am writing an application that takes the decoded output of tethereal and 
> processes it. When I run the this for a log time of about 1 day, the memory
> 
> usage of tethereal grows drastically - to about 1 GB and the machine becomes
> 
> unusable. I tried some options that have been suggested in the list like, 
> disabling unwanted protocols. I even tried this, but still the same result.
> 
> Any suggestion to avoid this problem..
> 
> I use a Ethereal 10.10 compiled on my Red hat Linux box. The command that I
> 
> use for tethereal is:
> 
> tethereal -V -l -R "rtcp || sip" -o rtcp.show_roundtrip_calculation:false
> 
> In the disabled_protos file, I have provided entries for all protocols 
> except rtcp, sip and udp.
> 
> Stepen Regan.
> 
>