Ask Your Question

Is there any memory leaks in wireshark?

asked 2019-10-26 07:19:37 +0000

leo gravatar image

When I open wireshark it uses some amount of memory (in the main window without opening any pcaps). After opening and closing a pcap after complete dissection, the memory usage shown in "task manager" window is increased significantly. I think that the memory usage must become as it was at the starting point, unless there is a memory leak. Am I write?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2019-10-26 09:02:54 +0000

Jaap gravatar image

MAybe, maybe not, your test is not conclusive. Your assessment is based on the assumption that Wireshark only uses the C library and, by extension, the Operating Systems memory management functions. It does not, it has build in memory slab and pool features to limit impact of fragmentation. I'm not even sure how the OS memory management enhancements come into play here, not releasing memory straight away.

What could be informative if the same capture file was opened and closed multiple times. Then the memory footprint would keep increasing in case of a memory leak.

edit flag offensive delete link more


Even the C library memory management functions typically don't release memory back to the operating system kernel when a free is done; it just adds that memory to a pool that it will try to use for future allocations.

As such, there's no guarantee that an OS tool that shows the memory usage for a process will show that the memory usage shrinks after you close a file in Wireshark.

Guy Harris gravatar imageGuy Harris ( 2019-10-26 19:36:26 +0000 )edit

There's an old wiki page describing all of this:

JeffMorriss gravatar imageJeffMorriss ( 2019-10-27 15:40:19 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-10-26 07:19:37 +0000

Seen: 160 times

Last updated: Oct 26 '19