Wireshark · Ethereal-users: Re: [Ethereal-users] Tethereal analyzing a large capture file crashes...

[Guy Harris <gharris@xxxxxxxxx>]

Joel R. Helgeson wrote:

> What seems to happen is that tethereal uses up the ram 
> and swap, up to a total of 2gigs used then it crashes and states that it 
> failed to allocate xxxx bytes of memory...

Is xxxx a small number (in which case it's probably just that a bunch of 
data structures built while reading the capture aren't freed, because 
it's not clear when they won't be needed), or an extremely large number 
(in which case it's probably because some dissector is reading a length 
field from the packet and trying to allocate a buffer big enough to hold 
all that data, even if the length field has an extremely large and 
possibly bogus value)?