Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] New packet list - out of memory?

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 06 Oct 2009 15:30:24 -0400
Anders Broman wrote:
Should we have a new allocator without the canaries?
I think either the current se_ allocations implementation need to be changed
Or the function removed. The result where WIRESHARK_DEBUG_SE_NO_CHUNKS=T
And loading is faster is puzzling.

Trying that on Linux (64-bit) with a capture file of mine, I get (all with SVN 30347, new packet list):

(no env settings)
CPU time ("user time" from 'times'): 40.491 seconds
VSZ (from ps aux): 995,644

With WIRESHARK_DEBUG_SE_NO_CHUNKS set:
CPU time: 43.048 seconds
VSZ: 1,128,076

With WIRESHARK_DEBUG_EP_NO_CHUNKS and WIRESHARK_DEBUG_SE_NO_CHUNKS set:
CPU time: 48.536 seconds
VSZ: 1,120,308


(It's a bit odd that memory usage goes up when chunks are off.)

Maybe Windows doesn't like big (10Mb) allocations? Another thing is that turning off chunks also turns off canaries. Don't know why that would make a difference in loading time. I can't imagine generating a few random numbers for each chunk would be that expensive.