This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi folks,

I need to do a long term capture on a server under high load and try to find session initiations with a TCP(SYN) that were not answered(SYN,ACK).

Since there is a high load on this server i thougt that I probably need capture filters so that i dont run out of memory on the server.

What i did was to add a capture filter that said "tcp[0xd]&2=2". It seems to work great. I see only SYN and SYN,ACK packets. I can then filter the capture with a display filter to look at the relevant IP address with a "ip.addr == 1.2.3.4".

My take on this is that wireshark will not use more memory than the amount of data that passes through from the capture filter.

My result is that i have ben running for 10 minutes capturing 19000 SYN and SYN,ACK packets. I have then used the display filter to narrow the result down to 48 packets. The problem is that Wireshark uses 2,43GB RAM after 10 minutes to store these 19000 packets. Some math on this says that it is using 126KB for storing each SYN/SYN,ACK.

Am i getting all this backwards somehow or could it be that more data is getting through the capture filter and stored in memory than what the capture filter says?

OS: Windows 2008 R2 Wireshark 1.8.3 64-bit

Thankfull for all help :)

asked 08 Nov '12, 07:52

MrTernstrom's gravatar image

MrTernstrom
6113
accept rate: 0%


Wireshark maintains state about conversations, i.e. SYN/SYN,ACK and this uses memory.

Use dumpcap to capture the data as this doesn't retain any state info. In addition you may want to set a snaplen (-s) to limit the amount of data actually captured and written to disk.

permanent link

answered 08 Nov '12, 08:06

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×184
×34
×23

question asked: 08 Nov '12, 07:52

question was seen: 2,164 times

last updated: 08 Nov '12, 08:06

p​o​w​e​r​e​d by O​S​Q​A