Wireshark-dev: Re: [Wireshark-dev] New packet list - out of memory?
From: Jeff Morriss <[email protected]>
Date: Tue, 06 Oct 2009 15:30:24 -0400
Anders Broman wrote:
Should we have a new allocator without the canaries?
I think either the current se_ allocations implementation need to be changed
Or the function removed. The result where WIRESHARK_DEBUG_SE_NO_CHUNKS=T
And loading is faster is puzzling.
Trying that on Linux (64-bit) with a capture file of mine, I get (all 
with SVN 30347, new packet list):
(no env settings)
CPU time ("user time" from 'times'): 40.491 seconds
VSZ (from ps aux): 995,644

CPU time: 43.048 seconds
VSZ: 1,128,076

CPU time: 48.536 seconds
VSZ: 1,120,308

(It's a bit odd that memory usage goes up when chunks are off.)

Maybe Windows doesn't like big (10Mb) allocations? Another thing is that turning off chunks also turns off canaries. Don't know why that would make a difference in loading time. I can't imagine generating a few random numbers for each chunk would be that expensive.