Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4051] Memory leak in TCP dissector (OutOfMemoryError isn't

Date: Mon, 28 Sep 2009 04:35:46 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4051


Gerfl <gkrames@xxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|OutOfMemoryError isn't being|Memory leak in TCP dissector
                   |caught at the top level     |(OutOfMemoryError isn't
                   |                            |being caught at the top
                   |                            |level)




--- Comment #2 from Gerfl <gkrames@xxxxxxx>  2009-09-28 04:35:43 PDT ---
Thank you for this hint.
I have 4GB virtual memory, so the out of memory error at approx. 3.5GB is
explained.

BUT: Why does tshark run out of memory so quickly?

Refined test case:
- Script performing FTP uploads in an endless loop; 
  FTP server (vsftpd) is throtteled to 100 KByte/sec 
  (roughly 1 MBit/s on the wire). 

- Capture filter is set to  -f 'tcp and (host <ipOfServer)'

- Watching thsark's memory consumption (using "top") shows ever 
  memory consumption increasing. 

- Extract from ~/.wireshark/preferences:
tcp.summary_in_tree: FALSE
tcp.check_checksum: TRUE
tcp.desegment_tcp_streams: FALSE
tcp.analyze_sequence_numbers: TRUE
tcp.relative_sequence_numbers: TRUE
tcp.track_bytes_in_flight: FALSE
tcp.calculate_timestamps: FALSE
tcp.try_heuristic_first: FALSE
ip.decode_tos_as_diffserv: TRUE # also tried FALSE, no difference
ip.defragment: TRUE
ip.summary_in_tree: FALSE
ip.check_checksum: TRUE
ip.tso_support: TRUE

- Disabled dissectors FTP and FTP-DATA.

- Out of memory crash after capturing 400MB.

The above taken together points to a memory leak somewhere in the
TCP dissector area. 
Maybe a "TCP version" of Bug#3913 (where test case was UDP)?


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.