The new version of wireshark 1.6.8 + are consuming excessive amounts of RAM memory, and has used up all the memory on the machine I am using.

Are you planning to go back to how 1.2.7 works, not using local RAM or at least minimize it so it doesn't grow more than 5 mb of memory.

with this memory usage on 1.6.8 and up, we cannot upgrade because this causes our servers problems when we are doing long term packet captures.

Also in 1.8.0, what happened to all the capture information in the options? how do I get those back?

Thanks Geoff

gspier@pivotinc.com

asked 20 Jul '12, 11:38

PapaPanthers's gravatar image

PapaPanthers
1111
accept rate: 0%

Also in 1.8.0, what happened to all the capture information in the options? how do I get those back?

To what capture information are you referring here?

(20 Jul '12, 14:00) Guy Harris ♦♦

Unfortunately more features means more memory usage :-(

Wireshark isn't the tool of choice for long term captures as it maintains state info about the captured packets so will always run out of memory eventually. Dumpcap will capture without retaining state so can be used for longer captures, but even that may cause issues as the capture files grows ever larger. In this case use the Dumpcap -b options to limit each capture file by size or time.

link

answered 20 Jul '12, 12:36

grahamb's gravatar image

grahamb ♦
4.2k21564
accept rate: 14%

The Out of Memory problem has been known since at least September 2005. Version 1.2.7 was released on March 31, 2010.

As suggested elsewhere, you should use dumpcap for long running captures, not Wireshark.

link

answered 20 Jul '12, 12:42

multipleinterfaces's gravatar image

multipleinte...
1.1k71230
accept rate: 12%

Are you planning to go back to how 1.2.7 works, not using local RAM or at least minimize it so it doesn't grow more than 5 mb of memory.

1.2.7, and every version of the software back to Ethereal 0.1, uses local RAM (as does every other application on your machine). Later versions might use more memory to store reassembled packet data, keep track of relationships between packets, etc.. We have, over time, made some changes to reduce the memory consumption of the packet list display (by using a different widget) and the table of all packets (by allocating them in bulk and not keeping two pointers in every entry in the table).

link

answered 20 Jul '12, 14:00

Guy%20Harris's gravatar image

Guy Harris ♦♦
7.9k118100
accept rate: 16%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×11
×4
×1

Asked: 20 Jul '12, 11:38

Seen: 1,121 times

Last updated: 20 Jul '12, 14:00

powered by OSQA