When I open wireshark it uses some amount of memory (in the main window without opening any pcaps). After opening and closing a pcap after complete dissection, the memory usage shown in "task manager" window is increased significantly. I think that the memory usage must become as it was at the starting point, unless there is a memory leak. Am I write?
MAybe, maybe not, your test is not conclusive. Your assessment is based on the assumption that Wireshark only uses the C library and, by extension, the Operating Systems memory management functions. It does not, it has build in memory slab and pool features to limit impact of fragmentation. I'm not even sure how the OS memory management enhancements come into play here, not releasing memory straight away.
What could be informative if the same capture file was opened and closed multiple times. Then the memory footprint would keep increasing in case of a memory leak.
Even the C library memory management functions typically don't release memory back to the operating system kernel when a free is done; it just adds that memory to a pool that it will try to use for future allocations.
As such, there's no guarantee that an OS tool that shows the memory usage for a process will show that the memory usage shrinks after you close a file in Wireshark.
There's an old wiki page describing all of this: https://wiki.wireshark.org/KnownBugs/...
Comments