Wireshark · Wireshark-users: Re: [Wireshark-users] tshark memory

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jan 19, 2010, at 12:26 PM, Abhijit Bare wrote:

> I have a problem with tshark memory usage. I need to use tshark for a read filter. However, it looks like tshark reads in the entire input file in memory. Is this correct?

No, it is not.  Neither Wireshark nor TShark read the entire input file into memory.

When it reassembles fragmented/segmented/etc. packets, however, the content of the reassembled packets *is* kept in memory.