I ran a test with and without options on a 600Mo capture file: the
result is the same, tshark takes 400Mo of memory. Is it normal ?
On Fri, Feb 29, 2008 at 12:31 PM, Edouard Funke <[EMAIL PROTECTED]> wrote:
> Thanks for all the information, i will try these options and see if
> ther
trying to
"follow" streams it is still a problem.
On Fri, Feb 29, 2008 at 12:14 PM, Guy Harris <[EMAIL PROTECTED]> wrote:
> Edouard Funke wrote:
> > The same issue happens with "normal" tcp trafic without any custom
> > plugin activated.
> > How can
The same issue happens with "normal" tcp trafic without any custom
plugin activated.
How can i deactivate reassembly in this case ? How different would be
my output ?
On Fri, Feb 29, 2008 at 11:19 AM, Guy Harris <[EMAIL PROTECTED]> wrote:
> Edouard Funke wrote:
> > The
The exact command i am using is :
tshark -r my_big_capture_file -T pdml -V | myprogram
It is tshark who is running out of memory (monitored). Could the pipe
have something to do with it ?
On Thu, Feb 28, 2008 at 7:12 PM, Guy Harris <[EMAIL PROTECTED]> wrote:
> Edouard Funke wrote:
>
Hello,
We are currently using wireshark PDML export functionnality (with
custom plugins) to export big capture files to be processed after.
We are constantly "hitting" the out of memory problem
(http://wiki.wireshark.org/KnownBugs/OutOfMemory) as wireshark keeps
information on packet list and for
