ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Ethereal-win32 : Memory not de-allocated when closing an old

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date: Wed, 16 Mar 2005 13:27:59 +0100
Hello,
I would like to comment on a posting from Alex Lam/Guy Harris from
March 7th about a possible memory leak:

>Alex Lam wrote:
>
>>I believe there is a memory leak in Ethereal-win32, v0.10.9, but 
>>dated back to at least 0.10.7.
>>The symptom is that memory is not de-allocated when you close a 
>>previous capture with the File->close menu command. 
>
>What if you then open a new file?
>
>We don't have separate "initialize" and "clear" routines for 
>dissectors, with the latter one freeing up data structures maintained 
>by the dissector >for a capture, and the former one initializing 
>those data structures; we just have an "initialize" routine which 
>does both.
>
>>In fact, each time you change the display filter, more memory is
>>required, even when you are just toggling between 2 filters.
>
>So you've found a leak even when you *don't* close captures? 

I can confirm Alex' observations that on both Windows and Linux
the allocated memory grows when changing a display filter.
In my case I'm filtering very large files (about ~75MB) and you
can see the memory consumption growing quite rapidly after using
a new display filter.

On file closure, the large(!) amount of memory is not being
freed. Opening another file doesn't help either.

Currently, after using some different display filters I have
to close Etheral completely and start again because then
Etheral has eaten up all the machine's memory.

Hope this help's.

BR,
Daniel