On Aug 2, 2011, at 12:21 PM, Alex Lindberg wrote:
> When I quit a custom build of Wireshark (Win32), although the application disappears from the desktop, it remains in memory.
What do you mean "remains in memory"?
Perhaps Windows - which probably means Windows NT these days, with XP and later being the predominant desktop versions - doesn't have the same model as UN*X, where
1) when a process exits, "anonymous" pages in the process address space, as allocated by malloc() and the like, simply disappear without having to be explicitly unallocated;
2) file-backed pages, such as pages from the executable image and dynamically-loaded code (shared libraries, etc.), remain in memory (but aren't wired into memory, so they're reused if you use the executable or the dynamically-loaded code again and are still in memory, but their page frames can be reused for other purposes);
but I doubt it does. This means that there is no need to explicitly free memory when Wireshark (or any other program) exits - it gets freed (and more quickly than if it were explicitly freed).
