Wireshark · Ethereal-dev: Re: [Ethereal-dev] Where is the memory consumed ?

["Guy Harris" <gharris@xxxxxxxxx>]

Pierre JUHEN said:
>     Where is the memory useb by the packets ?
>        on the capture side ?
>        on the wtap_dump side ?

None of the above.  Neither the capture side (i.e., the part that reads
packets from the capture device) nor the wtap_dump side should allocate
anything on a per-packet basis.

If, however, you're doing packet dissection, because you're using a read
filter, that *can* allocate per-packet data...

>     Behing which varaible / pointer ?

...but not behind any single variable.  Each dissector can allocate memory
of its own.