All, I think I've found a (very minor) memory leak in writing to a PCAP file. In drivers/net/pcap/rte_eth_pcap.c in open_single_tx_pcap around line 405 a pcap_t is allocated by pcap_open_dead but is never freed.
I see two obvious fixes: 1) Free the pcap_t immediately after either on pcap_dump_open success or failure 2) Set the pcap_t pointer internals->tx_queue[i]->tx->pcap so when the eth_dev_stop callback happens the pcap_t is freed. I believe the first is safe but am not a libpcap guru. Can someone please confirm this? Thanks, Stefan
