Hi, On README.malloc file, wireshark have two functions: -Ephemeral allocations: This functions allocate memory that will be automatically freed once the current packet dissection completes. -Seasonal allocations: This functions allocate memory that will stay around a lot longer but will be automatically freed once the current capture is closed and Wireshark opens a new capture.
Very good, this two functions work very well on open/close pcap file, but when wireshark/tshark run on live trafic (pcap_open_live), *shark more alloc without freeing. Maybe it is possible add new function or modify *shark code for malloc freeing on live analysis ? Regards Rmkml Crusoe-Researches.com -- Do you known Azwalaro project ? It's a ids/ips network open source based on specialized wireshark ! http://www.Crusoe-Researches.com/azwalaro/ _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
