This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am performing an SNA trace (capture filter is "not ip && not arp && not ether proto 0x8805 && not ether proto 0x8806 && not ether proto 0x0800"). I am collecting about 10 packets per minute; the last trace file was ~32KB -- small capture data!

Running on Win XP SP3 with latest patches. 1GB RAM, P4 2.66 CPU.

I am seeing the wireshark.exe's allocated memory rising at about 2MB / 10 seconds until the process crashes at around 1GB. I can see the system allocated memory graph climb up steadily until the crash every time.

I am trying 1.4 now to see if it has the same problem.

Is there anything I can collect for you to help you find the leak?

asked 25 May '12, 15:21

BobbyW's gravatar image

BobbyW
1112
accept rate: 0%

edited 25 May '12, 15:22

Running the same trace / filter on 1.4.13, it has been sitting at 60MB allocated for 30 minutes now ... I think 1.6.8 definitely has a leak.

(25 May '12, 16:31) BobbyW

Is there anything I can collect for you to help you find the leak?

I would suggest collecting as many packets as you can using the same capture filter as you did previously, namely, "not ip && not arp && not ether proto 0x8805 && not ether proto 0x8806 && not ether proto 0x0800", but stop capturing shortly before you run out of memory. Then save the resulting packets to a capture file, open a bug report, and attach the capture file to it so someone can use it to help analyze what's going on and hopefully provide a fix, if possible.

permanent link

answered 27 May '12, 18:12

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

1

Even if Wireshark does crash, the temporary should still be around; you could use that to attach to a bug report. See the Q7.12 in the FAQ.

(29 May '12, 06:57) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×254
×23
×3

question asked: 25 May '12, 15:21

question was seen: 3,385 times

last updated: 29 May '12, 06:57

p​o​w​e​r​e​d by O​S​Q​A