David S wrote: > Bill Meier <wme...@...> writes: >> I wouldn't have expected dumpcap memory usage to grow very much over >> time as packets are captured. If it does that sounds like a bug. >> >> However, I'm a little confused: >> >> You indicate that dumpcap memory usage is growing but you then say >> you're "using the unencryption feature of the packet dissector" >> which is not in dumpcap but is in wireshark/tshark. >> >> Wireshark/tshark memory will increase as a function of the number of >> packets dissected. That's the nature of the beast. >> >> ___________________________________________________________________________ >> Sent via: Wireshark-dev mailing list <wireshark-...@...> >> Archives: http://www.wireshark.org/lists/wireshark-dev >> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev >> mailto:wireshark-dev-requ...@...?subject=unsubscribe >> >> > > Ok, I'll run it again and see if I observe the same behaviour. It was > definitely dumpcap which had high memory and cpu usage. > > Sorry, I mis-understood what was going on with the dissectors, I thought that > if I ran the capture through Wireshark the captures would be decoded, I was > wrong as the raw packets were output to file (obviously). >
I should have been clearer in my original rely. Wireshark runs dumpcap to do the actual capture. Dumpcap writes to a file and Wireshark reads from the file. So: When running a cature through Wireshark, the catures are decoded (by Wireshark). ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
