This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Some workaround about out of memory problem

0

I find some workaround analyze about out of memory problem at http://blog.packet-foo.com/2013/05/the-notorious-wireshark-out-of-memory-problem/. In "Around #2", the author noted that "Most things Wireshark displays about a frame is stored in there. Additionally there are hash tables of reassembled data conversation".

  1. I've found the fdata in process_packet(tshark.c), but it's freed at the bottom of the function. Are there any more fdatas not freed ?

  2. Where are the hash tables that store reassembled data conversation ?

@kurt @Guy Harris

Thanks in advance.

asked 17 Mar '14, 01:48

metamatrix's gravatar image

metamatrix
56161619
accept rate: 100%

edited 17 Mar '14, 01:50


One Answer:

1

Not to supprisingly reassemble.c, conversation.c in epan

answered 17 Mar '14, 04:58

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%