Wireshark-users: Re: [Wireshark-users] running multiple instances

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 10 Nov 2009 09:24:23 -0800

On Nov 9, 2009, at 1:21 PM, Nicole Powell wrote:

When I try this it gives an application error and shuts down Tshark. I tried these two commands on a smaller file (144KB) and it works fine; the file I am trying to use now is 4.59MB. Could it be the file size?

Yes, it could be. There are some cases where TShark keeps information around in memory even after it's no longer needed (because TShark and Wireshark use the same dissector code and dissector framework, and, in Wireshark, that information could be needed as long as the file is open), so it can use a significant amount of memory on a large file.