This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

1.10.6-7: Memory Leak

0

Running either 1.10.6 or 1.10.7 I can watch the memory usage of wireshark.exe continue to climb until it finally crashes.

Setup;

  • Windows 7 64-bit
  • 600GB Intel SSD
  • Dual core Atom processor
  • 2GB mem
  • Capture to multiple files, 10MB each
  • Working via remote desktop
  • Capturing with disply of packets turned off (update of packets in real time unchecked).

Wireshark starts with about 54MB of memory. As soon as I start the capture it climbs to just over 159MB. While its running I can watch the memory continue to climb at a rate of 8-20k per second. Note that dumpcap remains around 3MB at all times.

asked 23 Apr '14, 15:23

VanAwful's gravatar image

VanAwful
1111
accept rate: 0%


2 Answers:

2

This is not a memory leak, it is just Wireshark creating and holding additional information about the packets, like reassembly data. Dumpcap just writes files without creating that kind of data, which is why its memory consumption is stable.

See this blog post for more info: http://blog.packet-foo.com/2013/05/the-notorious-wireshark-out-of-memory-problem/

answered 23 Apr '14, 15:39

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

Is your display depth set to 16 bits? If so this might be due to a memory leak in GTK+.

answered 23 Apr '14, 16:32

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
3.3k92258
accept rate: 24%