Wireshark · Wireshark-dev: Re: [Wireshark-dev] Wireshark Memory Usage

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

On Thu, Sep 22, 2016 at 2:49 AM, Paul Offord <Paul.Offord@xxxxxxxxxxxx> wrote:

During my investigation into the performance issues with transum I noticed an apparent memory leak.  Each time I close and re-open the same 40 MB trace file, Wireshark memory usage increases by about 14 MB.  I thought it was a problem with my code but decided to check memory usage on the current 2.2 release.  I see the same problem:

 

 

Is this expected or is it a bug?

It's not uncommon to see that.  Whether it's a bug or not would require more investigation.  But keep in mind a number of factors:

* Wireshark intentionally doesn't free all memory when closing a file - that memory may be marked as "free" in Wireshark's memory allocator but kept around for future reuse (at least this was the case with emem; I suppose wmem is the same)

* Even if Wireshark free()s memory the libc (or whatever it is on Windows) may not return the memory to the OS for the same reasons as above

* We do run a fairly strict memory leak check on the buildbot - though that's with tshark and on Linux