Wireshark-dev: Re: [Wireshark-dev] PDML export on big capture files
From: Guy Harris <[email protected]>
Date: Fri, 29 Feb 2008 02:19:39 -0800
Edouard Funke wrote:
The exact command i am using is :
tshark -r my_big_capture_file -T pdml -V | myprogram

It is tshark who is running out of memory (monitored). Could the pipe
have something to do with it ?
No - TShark has no idea that its standard output is being piped to 
another program (that's what pipes are all about - being able to take 
output of one program and, rather than looking at it yourself or saving 
it to a file, feeding it to another program).
It's probably a reassembly issue; particular protocols might offer an 
option to disable reassembly, but, as per my earlier mail, you'd get 
different output if you did that.