How to handle memory growth in tshark while reading from a captured file.
Regarding https://blog.wireshark.org/2014/07/to... , I see that the "-b" flag "ring buffer" only applies to the live capture mode with "-i". How to handle the memory growth while reading a very large capture file using "-r" option. e.g. ./tshark -r example.pcap ??
Tried following changes to discard states : In process_cap_file(), I added following code after each process_packet_single_pass() call :
if (perform_stateless_analysis) {
epan_dissect_free(edt);
epan_free(cf->epan);
cf->epan = tshark_epan_new(cf);
edt = epan_dissect_new(cf->epan, create_proto_tree, print_packet_info && print_details);
}After these changes the %CPU and %MEM still seems to grow as observed by the 'top' command. The processing time also have increased drastically. If we do not want to maintain the states, is there anything else we can do to reduce the memory consumed and the processing time??
Comments
Split the capture file into smaller pieces? Slice the packets in the capture file to remove layers of no interest?
Unfortunately processing big captures takes lots of CPU and memory.
Can you explain a bit more on what could be the reason for the memory consumption even after freeing up the memory by using epan_dissect_free(edt); epan_free(cf->epan) calls after each packet is processed ??
What about using "-M" option, does that help? (not able to look into the details now, the documentation is quite sparse).
There is some improvement with the -M option but not much. But observed that if I run the same tshark command with -V option (add output of packet tree), the %MEM as monitored by 'top' is very very low. Any particular reason for the same ?? e.g. ./tshark_orig -M 1000 -Vr ../tigo.pcap