rmkml wrote: > but tcp session is closed properly (wget download quit properly) > maybe add parameter for freeing memory after tcp fin/reset ?
That could perhaps be done for tcpdump and TShark (although it doesn't help the case where connections aren't closed properly; tcpdump, when run without -S, is vulnerable to SYN flood), but can't be done for Wireshark (as you might later click on a packet that's part of the connection). That's also probably not the biggest problem. > and maybe add memory parameter alloc limit ? (icmp/udp/ipproto and others) We could, but, at least for me, if the default for that parameter weren't "infinity", I'd change it to infinity in my configuration. The biggest problem is probably reassembly. In your case, if you were doing a *single* wget, note that the *entire* contents of the file being downloaded will be reassembled. A limit on the amount of data that can be reassembled - with the reassembly code ideally just discarding the code and making the tvbuff with the reassembled data short (i.e., its reported length would be the total amount of data to be reassembled, and its data length would be the amount of data it kept), so that the HTTP dissector doesn't restart dissecting in the middle of the file being downloaded - would probably handle that. You can, of course, just run with "-o tcp.desegment_tcp_streams:false" to disable TCP reassembly entirely.... _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
