Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Growing memory with tshark & Lua

From: Martin Kaiser <lists@xxxxxxxxx>
Date: Sat, 21 Nov 2020 17:17:41 +0100
Hi Thomas,

Thus wrote Thomas Baudelet (thomas.baudelet@xxxxxxxxx):

> Hi Devs,

> When Wireshark profiles are correctly tuned (few protocols, disabled TCP
> reassembly & analysis, bytes tracking, timestamps calculations, IP defrag),
> tshark memory doesn't grow at all.

> Simply adding a simple Lua script with 1 listener and 1 field, without doing
> nothing with them, then the memory grows along with pcap file.

> As tshark memory alone doesn't grow due to correct profile, I'd have
> expected Lua to forget about all values also on each Listener.packet() loop,
> but it doesn't seem to be coded like this.

> Lua script by itself doesn't consume that much memory according to
> collectgarbage("count").

> So it seems that Lua+Listener+Field is forcing { tshark / Lua } to collect
> all packets as if some reassembly was asked.

> Anybody has some hints about this, the section of code involved here ?

> And most important : is there a way to prevent the memory growing !

would you mind sharing the profile and the lua script?

Thanks,
Martin