Wireshark-dev: Re: [Wireshark-dev] regarding memory failure in wireshark
From: Jeff Morriss <[email protected]>
Date: Fri, 14 Nov 2008 10:52:28 -0500

Sake Blok wrote:

A second option is to use more then one capture
files in a ring buffer fashion limiting each file's size to a reasonable
(for your system) length. This could be easily configured in Wiresharks
capture start dialog.
Unfortunately wireshark will not flush state information when starting
to write to a new file. This means that you will still run out-of-memory
in the end.
Hmmm?  I was pretty sure Wireshark did free just about everything when 
closing the capture file.  Or am I mistaken?