I modify a version of tshark to analyze real-time packages on Gigabytes port, find out the info I concerned, and write them in files. When facing multi-days capture, the memory grows continuously. I shield the output printing, and write temporary pcapng files in multiple ring buffers to reduce the memory cost. However, memory grows at 20 to 30 MB per hour. How to reduce the memory cost further?
ps: I don't need most of the packets info for summary printing, only request and response pack info are concerned. So I think memory can be kept at a very low level. Any ideas to release the excess memory? Appreciated.
asked 03 Mar '14, 21:19
If you need "request and response" packet info, by which I think you mean you need the information of which response packet matches which request packet, how would you avoid keeping a list of all previous packets? (that should be what is growing the memory if I recall correctly, by the way)
I mean as far as tshark knows, packet #100000000 could be a response to packet #3.
answered 04 Mar '14, 04:52