Hi,
On README.malloc file, wireshark have two functions:
-Ephemeral allocations: This functions allocate memory that will be automatically freed once the current packet dissection completes.
-Seasonal allocations: This functions allocate memory that will stay around a lot longer but will be automatically freed once the current capture is closed and Wireshark opens a new capture.
Very good, this two functions work very well on open/close pcap file,
but when wireshark/tshark run on live trafic (pcap_open_live), *shark more alloc without freeing.
Maybe it is possible add new function or modify *shark code for malloc freeing on live analysis ?
Regards
Rmkml
Crusoe-Researches.com
--
Do you known Azwalaro project ?
It's a ids/ips network open source based on specialized wireshark !
http://www.Crusoe-Researches.com/azwalaro/
