rmkml wrote: > thx again for reply Guy, > >> You can, of course, just run with "-o tcp.desegment_tcp_streams:false" >> to disable TCP reassembly entirely.... > > tshark -ta -ni eth0 -o tcp.desegment_tcp_streams:false > and tshark use more than 500Mo! > if I reenable tcp.desegment_tcp_streams and tshark use only 220Mo, > why ?
Good question. I don't see that, however: UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME COMMAND XXX 26205 7110 0 31 0 267796 93624 - S+ p6 2:27.13 tshark -ta -i en1 host mirror.cs.wisc.edu XXX 26223 7110 0 31 0 233036 27500 - S+ p6 0:22.83 tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host XXX 26229 7110 0 31 0 150152 19728 - S+ p6 0:00.60 tshark -ta -i en1 -o tcp.desegment_tcp_streams:false host where the first of those is after a download of an ISO from mirror.cs.wisc.edu with reassembly on, the second is after a download with reassembly off, and the latter is after TShark was started with no traffic whatsoever. The *added* virtual memory with reassembly on is 117.644 MB, and the *added* virtual memory with reassembly off is 82.884 MB. The ISO is 108 MB, but there's only 34.760 MB more memory consumed with reassembly on. I'll look at running the "leaks" program with MallocStackLogging on, to see where the memory's going. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
