Wireshark mailing list archives
Reducing memory usage by not storing reassembled packet data
From: Guy Harris <guy () alum mit edu>
Date: Thu, 10 May 2012 20:02:31 -0700
On May 10, 2012, at 1:24 AM, Anders Broman wrote:
- In the reassembly routines If I remember correctly, I might be wrong I think we may waste memory for TCP. Fragments and reassembled fragments? - It might be possible to store file pointer and length rather than the fragment data and read in that data when needed.
Possible in some cases, although when I thought about it recently I realized that would only handle some cases. If a reassembled packet is made up from other reassembled fragments (e.g., the unlikely-in-real-life case of reassembly of TCP segments in fragmented IP datagrams, or the more-likely case of higher-level packets reassembled from lower-level packets reassembled from TCP segments), finding the underlying chunks from the capture could be a bit of work and there wouldn't be a one-to-one correspondence between chunks referred to by the reassembly data structures and chunks from the capture file. If a reassembled packet is made up from fragments extracted from decompressed or decrypted packets, then the chunks referred to by the reassembly data structures don't correspond *at all* to chunks from the capture file. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Random feature and enhancements ideas (topics for Sharkfests developers room?) Anders Broman (May 10)
- Re: Random feature and enhancements ideas (topics for Sharkfests developers room?) Jasper Bongertz (May 10)
- Reducing memory usage by saving fewer time stamps in frame_data Guy Harris (May 10)
- Reducing memory usage by not storing reassembled packet data Guy Harris (May 10)
- Re: Reducing memory usage by not storing reassembled packet data Anders Broman (May 10)
- Using the per-packet protocols string when filtering Guy Harris (May 10)
- Re: Using the per-packet protocols string when filtering Anders Broman (May 10)
- Re: Using the per-packet protocols string when filtering Guy Harris (May 10)
- Re: Using the per-packet protocols string when filtering Anders Broman (May 10)
- Re: Using the per-packet protocols string when filtering Anders Broman (May 10)