This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Memory Leak in 1.6.8?

0

I am performing an SNA trace (capture filter is "not ip && not arp && not ether proto 0x8805 && not ether proto 0x8806 && not ether proto 0x0800"). I am collecting about 10 packets per minute; the last trace file was ~32KB -- small capture data!

Running on Win XP SP3 with latest patches. 1GB RAM, P4 2.66 CPU.

I am seeing the wireshark.exe's allocated memory rising at about 2MB / 10 seconds until the process crashes at around 1GB. I can see the system allocated memory graph climb up steadily until the crash every time.

I am trying 1.4 now to see if it has the same problem.

Is there anything I can collect for you to help you find the leak?

asked 25 May '12, 15:21

BobbyW's gravatar image

BobbyW
1112
accept rate: 0%

edited 25 May '12, 15:22

Running the same trace / filter on 1.4.13, it has been sitting at 60MB allocated for 30 minutes now ... I think 1.6.8 definitely has a leak.

(25 May '12, 16:31) BobbyW

One Answer:

2

Is there anything I can collect for you to help you find the leak?

I would suggest collecting as many packets as you can using the same capture filter as you did previously, namely, "not ip && not arp && not ether proto 0x8805 && not ether proto 0x8806 && not ether proto 0x0800", but stop capturing shortly before you run out of memory. Then save the resulting packets to a capture file, open a bug report, and attach the capture file to it so someone can use it to help analyze what's going on and hopefully provide a fix, if possible.

answered 27 May '12, 18:12

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

1

Even if Wireshark does crash, the temporary should still be around; you could use that to attach to a bug report. See the Q7.12 in the FAQ.

(29 May '12, 06:57) JeffMorriss ♦