[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wireshark-users
Subject:    Re: [Wireshark-users] WS 1.2.6 is crashing by opening a 147MB file
From:       Guy Harris <guy () alum ! mit ! edu>
Date:       2010-05-25 19:17:09
Message-ID: 908429DE-D1B1-4FEA-9DB8-71599C41F8CC () alum ! mit ! edu
[Download RAW message or body]


On May 25, 2010, at 11:20 AM, János Löbb wrote:

> What am I doing wrong ?  After the crash top showed still 2340M free on the machine \
> and the disk has 52GB free space.  So I do not think I ran into some kind of \
> limitation.

You'd be surprised at how much memory Wireshark can eat, unfortunately:

	http://wiki.wireshark.org/KnownBugs/OutOfMemory

Note also that what matters isn't the *physical* memory, but the *virtual* memory; \
Wireshark is a 32-bit program, so its *total* address space is limited to 4GB, \
regardless of how much memory you have and how much disk space could be used for swap \
files.  Address space could also be lost to fragmentation.

> Should I try with 1.2.8 or with a development of 1.3.x ?

I don't see any memory leak fixes between 1.2.6 and 1.2.8:

	http://wiki.wireshark.org/Development/Trunk-1.2

although I might have missed something.

Fixing the memory consumption issues involves some significant changes that won't go \
into the bug-fix releases; the development train does have some changes that reduce \
memory consumption (with the old packet list widget, every single string in every \
single column of every single row had a copy of its string - that's the way the GTK+ \
widget in question works - and that could eat a significant amount of memory; with \
the new packet list widget, not all columns have copies made of them), so 1.3.x might \
be worth trying.

There are some other changes that could significantly reduce the amount of memory \
used, but they require some more significant changes, and won't happen for \
1.3.x/1.4.x. ___________________________________________________________________________
 Sent via:    Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@wireshark.org?subject=unsubscribe


[prev in list] [next in list] [prev in thread] [next in thread]