Revision history  [back]

MAybe, maybe not, your test is not conclusive. Your assessment is based on the assumption that Wireshark only uses the C library and, by extension, the Operating Systems memory management functions. It does not, it has build in memory slab and pool features to limit impact of fragmentation. I'm not even sure how the OS memory management enhancements come into play here, not releasing memory straight away.

What could be informative if the same capture file was opened and closed multiple times. Then the memory footprint would keep increasing in case of a memory leak.