Wireshark-dev: Re: [Wireshark-dev] memory allocation assertion failure reading 219MB file with
From: Ulf Lamping <[email protected]>
Date: Fri, 25 Aug 2006 09:38:27 +0200
ronnie sahlberg wrote:
i think significant parts of the utilized memory is memory allocated by wireshark itself for things like reassembly and state management of protocols.
since most se allocation is done from within a dissector
once more/most of this is converted to use emem allocators we could maybe do something like :
1, set an upper limit on how much memory we allow to be allocated by 
the se allocator
2, when se_alloc is called and we have reached this limit,   just 
cause a new exception MemError
to cause dissection of the packet to be aborted but allow wireshark to 
this might actually work
I tried something different recently, but failed to get a reliable solution (at least on Win32):
Before the loading of a packet, get the amount of free memory from the 
system and stop loading packets when only a specific amount is left.
Depending on the threshold to stop, this ended up in:

- if the threshold is too high, leaving too much memory unused
- if the threshold is too low, running out of memory before the threshold triggered
This may be caused by the allocation of huge amounts from the se_ and 
alike functions, but I guess it's caused by the unreliable amount of 
current free memory.
I couldn't get a good clue at which point Win32 writes out memory to the 
swapfile, making predictions about the free memory very difficult.
I could check in the code #ifdef'ed, so others can have a look and 
probably find a better way than I did ...
Regards, ULFL