ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] New packet list - out of memory?

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Mon, 05 Oct 2009 18:48:52 -0400
Bill Meier wrote:
A data point: A few days ago while working on bug #2375 I noticed that on Windows that if I defined the env logicals to not use se_alloc & etc that *much* less memory was required to load a capture. (20% of that used with se_alloc & etc ? I don't quite remember).


Details:

Env: Windows Vista

Actions:

1. Load Wireshark
   Determine "Private Working Set", "Working Set", "Commit Size"

2. Load a 40 Meg capture file.
   Determine ....  again

The above was done for:

a. Wireshark with new_packet_list:

b. Wireshark w/new_packet_list:
    set WIRESHARK_DEBUG_EP_NO_CHUNKS=T
    set WIRESHARK_DEBUG_SE_NO_CHUNKS=T

c. Wireshark without new packet list

d. Wireshark without new packet list
    set WIRESHARK_DEBUG_EP_NO_CHUNKS=T
    set WIRESHARK_DEBUG_SE_NO_CHUNKS=T

Measurements

Note: The Working Set was always about 20 Meg larger than the
   Private Working Set(PWS) so only the PWS is shown.

(All values in Megs)
                                       EP/SE Chunks        No Chunks
                                       PWS  Commit        PWS  Commit
                                       ---- -------     ----- -------
Wireshark: current_packet_list
     After startup:                     42      62         42     52
     After 40M CF load:                180     399        195    205

Wireshark: new_packet_list:
     After startup:                     42      62         42     52
     After 40M CF load:                136     564        165    177


A conclusion:

Commit Size (which I believe is the amount of VM address space used
   by the process and which is presumably the limiting factor for
   memory usage).
      - Best for new_packet_list/no_chunks;
      - worst (quite) for new_packet_list/chunks;


Comments welcome...

(I did these tests somewhat quickly so I could have missed something...)


Bill