I recently upgraded my Wireshark from 1.x to 2.2.2 and noticed that the memory usage on Wireshark is excessively high. For example, I have a 2MB capture file and when I opened it in 2.2.2, it used almost 500MB of RAM. If I open the same file on 1.x, the memory was about 128MB.
Has anybody seen something like this before?
asked 11 Dec '16, 19:36
Or it could be related to a preference setting. To confirm this, you could make a backup of your personal configuration folder (location found in Help -> About Wireshark -> Folders), empty it and restart Wireshark (it will take the default settings).
If it changes the behavior, then we could investigate which setting is impacting, and whether it is expected or not. For example, are you doing some TLS decryption? If yes, what's the memory usage if you remove the keys?
answered 13 Dec '16, 05:11
How did you determine the memory usage has increased? Did you compare before and after loading the file, and did you do anything else while the capture was loaded?
answered 12 Dec '16, 06:42
edited 13 Dec '16, 05:05
I was having extreme memory consumption issues, and Wireshark was going into a "not responding" state regularly. As a test I started task manager (to watch memory usage) then started a wireshark capture on my laptop wired connection with nothing much going on.
answered 15 Jun '17, 12:10
edited 15 Jun '17, 12:51