Wireshark-dev: Re: [Wireshark-dev] Q: tshark memory usage
From: Kenichi Okuyama <[email protected]>
Date: Mon, 23 Jun 2014 02:14:25 +0900
Hi Kurt,

This might not be of help to you, but just in case.

I did had similar issue while I was running wireshark/tshark on both
32bit Linux, 32bit Windows XP machine.
However, after I moved to both 64bit Linux, 64bit Windows7, I have not
faced this issue anymore.

It is ture that I do have many more memory and swap area size after I
moved to 64bit environment.
But I don't believe moving from 3Gbyte environment to 4Gbyte
environment would make huge difference.
Except for one thing. Available "ADDRESS SPACE SIZE".

I did not follow all the messages you've wrote, but from above facts,
I'm assuming that
wireshark/tshark requires LARGE ADDRESS SPACES. and you're running out of
"contiguous memory address space" rather than "memory" itself.
# If the memory usage is being fragmented, and yet allocator requires
for long contiguous
# memory chunk inside, you will run out of address space while having
enough memory.

Maybe sharing the information about your environment, especially about
32bit/64bit environment,
would be of help to identify why @hoangsonk49 could run tshark for
6month while you can't.

Sorry in case this was not right.
Kenichi Okuyama