I am running wireshark 1.0.4 on SLES 10 on dual quadcore Xeon 3GHz with 16G memory. Tshark is using one full core.
Should I try latest version?
Thanks,
Abhijit
On Tue, Jan 19, 2010 at 2:40 PM, Anders Broman
<a.broman@xxxxxxxxx> wrote:
-----Ursprungligt meddelande-----
Från: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] För Guy Harris
Skickat: den 19 januari 2010 22:07
Till: Community support list for Wireshark
Ämne: Re: [Wireshark-users] tshark memory
On Jan 19, 2010, at 12:57 PM, Abhijit Bare wrote:
>> After 2 hours, my tshark process is using 3.6G RESIDENT memory and ~ 500G
>>VIRT memory in top output.
>
>To quote my reply:
>
>> When it reassembles fragmented/segmented/etc. packets, however, the
>>content of the reassembled packets *is* kept in memory.
>
>Other data structures that maintain state are also kept in memory.
What version on which platform? Some work to reduce memory usage and
Speed up filtering has been done in the development version you may want to
try that out. Although 2.5 TB is most probably to much depending on the
Type of traffic captured and if reassembly is turned of or on.
Regards
Anders
