Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] New packet list - out of memory?

From: didier <dgautheron@xxxxxxxx>
Date: Thu, 08 Oct 2009 09:33:52 +0200
Le mercredi 07 octobre 2009 ᅵ 17:01 +0200, Anders Broman a ᅵcrit :
> Hi,
> If some one's interested here's the emem statistics for the file:
> #define EMEM_ALLOCS_PER_CHUNK (EMEM_PACKET_CHUNK_SIZE / 64)
> PWS	  Commit		
>  43 492	     64 512	
> 332 052	    471 116	         
> Loading time 54.740
> 
> -------- SE allocator statistics --------
> Using chunks, using canaries
> No fully used chunks, nothing to do
> 
> -------- SE allocator statistics --------
> Using chunks, using canaries
> No fully used chunks, nothing to do
> 
> -------- SE allocator statistics --------
> Using chunks, using canaries
> 
> ---------- Allocations from the OS ----------
> ---- Headers ----
>         (    Chunk header size:         28
>           + Canary header size:     819204)
>         *     Number of chunks:         24
>         -------------------------------------------
>         = 19661568 total space used for headers
> 
> ---- Buffer space ----
>         Chunk allocation size:   10485760
>         *    Number of chunks:         24
>         -------------------------------------------
>         = 251461632 (251658240 including guard pages) total space used for buffe
> rs
>         -------------------------------------------
> Total allocated from OS: 271123200
> 
> ---------- Allocations from the SE pool ----------
>    Number of SE allocations:    3932160
> Bytes used (incl. canaries):  144507024
>     Bytes used for canaries:   35148246
>       Bytes unused (wasted):  106954608
> 
> ---------- Statistics ----------
> Average SE allocation size (incl. canaries):  36.75
> Average SE allocation size (excl. canaries):  27.81
>         Average wasted bytes per allocation:  27.20
>  Space used for headers + unused allocation: 107773840
> --> % overhead/waste: 39.75
> 
> Allocation distribution (sizes include canaries):
> size <    32:   697363
> size <    64:  2547659
> size <   128:   686123
> size <   256:    20722
> size <   512:      717
> size <  1024:        0
> size <  2048:        0
> size <  4096:        0
> size <  8192:        0
> size > 16384:        4
> 
> Regards
> Anders 
Not very good. 

But are canaries used at all? In my understanding without
DEBUG_INTENSE_CANARY_CHECKS they are never checked and it's unset by
default.

You can try with 
setenv WIRESHARK_DEBUG_SE_NO_CANARY
but first replace the padding with the right value: in emem.c
@@ -524,7 +467,7 @@
                 if (use_canary)
                        pad = emem_canary_pad(size);
                 else
-                       pad = 8;
+                       pad = ((8 - (size & 0x7)) & 0x7);

                size += pad;

Didier