Wireshark · Wireshark-dev: Re: [Wireshark-dev] Memory consumption in tshark

[Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>]

On Tue, Aug 27, 2013 at 06:17:13PM -0400, Evan Huus wrote:
> As Anders says, this is because we have no way right now to selectively
> discard it: much of the data is stored in a way that we can only get rid of
> all of it, or none.

I'm not sure why we want to do selectvely discard, I'm fan of 'get rid of all of it'.

> I'm sure there are some significant improvements we could make if somebody
> figures out how, 

It's quite simple just call epan_free(), epan_new() after each packet
(or every N-th packet, or 
when dissection throw OutOfMemory exception - ups it could be too late ;])