ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 4806] Huge pcap files are also completely loaded into memo

Date: Sat, 29 May 2010 04:03:09 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4806

--- Comment #1 from Anders Broman <anders.broman@xxxxxxxxxxxx> 2010-05-29 04:03:07 PDT ---
Unfortunately that's not so easy, Wireshark does NOT hold the entire file in
memory but keep state information of packets, reassembly data etc in memory.
Unfortunatly it's not possible to predict the amount of memory neeeded for any
particular trace file as it depends on the protocols contained in the file and
the users preference settings. There is no owerall tracking of memory consumed
rather memmory is allocated as needed bu the various functions called when
dissecting a packet.
The glib memory allocation functions used give no warning when memory is
exhaused and even it the more modern versions where used the above problems
would still have to be adressed some how.
Regards
Anders

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.