Long running tshark process and "-M" flag

asked 2025-03-06 13:31:01 +0000

I have a long running tshark process where I feed packets through pipe. I would expect that when the "-M 10000" flag is in use, tshark memory usage should remain stable. However tshark memory usage (RSS) keeps growing indefinitely and linearly

edit retag flag offensive close merge delete

Comments

Please update question with output of tshark -v

Chuckc ( 2025-03-06 13:37:49 +0000 )edit

Are you logging stderr?
fprintf(stderr, "resetting session.\n");

C:\Users\wireshark>"c:\Program Files\Wireshark\tshark.exe" -i 4 -M 5
Capturing on 'Wi-Fi'
    1   0.000000 ...
    2   0.033292 ...
    3   0.242135 ...
    4   0.244390  ...
    5   0.245864 ...
resetting session.
    1   0.272589  ...

Chuckc ( 2025-03-06 13:47:17 +0000 )edit

Will update the output of "-v" soon. Yes, I periodically see "resetting session". Still RSS keeps growing

yurac777 ( 2025-03-06 13:58:22 +0000 )edit

Output of "tshark -v":

Running as user "root" and group "root". This could be dangerous.
TShark (Wireshark) 4.5.0 (v4.5.0rc0-1486-ge96a549269cc).

Copyright 1998-2025 Gerald Combs <[email protected]> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).
This is free software; see the file named COPYING in the distribution. There is
NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compile-time info:
 Bit width: 64-bit
  Compiler: GCC 11.4.0
      GLib: 2.72.4
 With:
  +Gcrypt 1.9.4              +libpcap                   +PCRE2 10.39 2021-10-29
  +GnuTLS 3.7.3 and PKCS#11  +libxml2 2.9.13            +zlib 1.2.11
 Without:
  -brotli              -LZ4                 -Snappy
  -Kerberos            -MaxMind             -zlib-ng
  -libnl               -nghttp2             -Zstandard
  -libsmi              -nghttp3
  -Lua                 -POSIX capabilities

Runtime info:
      OS: Linux 6.5.0-1027-oem
     CPU: 13th Gen Intel(R) Core(TM) i7-1370P (with SSE4.2)
  Memory: 63940 MB of physical memory ...

(more)

yurac777 ( 2025-03-06 16:18:50 +0000 )edit

Have you looked at using the -b flag?

See: https://blog.wireshark.org/2014/07/to...

cmaynard ( 2025-03-06 18:17:20 +0000 )edit

see more comments

Long running tshark process and "-M" flag

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

Long running tshark process and "-M" flag edit

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

Long running tshark process and "-M" flag