Memory consumption keeps increasing as I dissect more than one pcap files

Question

This might be a trivial question - My program is making use of libwireshark API, notably epan related calls to dissect pcap files. I notice that as I process one file and another, the memory consumption keeps increasing. I have code similar to the following:

for each pcap file {
    init_dissection();
for each packet {
    frame_data_init()
    epan_dissect_init()

    frame_data_set_before_dissect()
    epan_dissect_run()
    frame_data_set_after_dissect()

    epan_dissect_cleanup()
    frame_data_cleanup()
}

cleanup_dissection();

}

While I understand the two cleanup functions don’t free up all processed data related to the current packet as future packet dissection within the same file might make use of the data, these data, however, are completely useless when I move on to the next pcap file. I can’t seem to identify the function that would free these data up after I am done with a file, and I come to speculate that libwireshark is meant to process one file and exit, like tshark does - Am I right?

My current workaround is to restart my program for each pcap file to free up all used memory - ugly, however, as my program is supposed to run as a daemon… Wonder if there is a better approach..

Thanks,

Answer 1

I come to speculate that libwireshark is meant to process one file and exit, like tshark does - Am I right?

No. libwireshark is meant to be used by Wireshark, which lets you close files and open new files.

What you want is something such as

for each pcap file {
    epan_t *epan = epan_new();
    initialize the epan in question;
    for each packet {
        frame_data_init();
        epan_dissect_init();
        frame_data_set_before_dissect();
        epan_dissect_run();
        frame_data_set_after_dissect();
        epan_dissect_cleanup();
        frame_data_cleanup();
    }
    epan_free(epan);
}

epan_free() is important here.