Re: tshark memory

[Guy Harris <guy () alum mit edu>]

On Jan 19, 2010, at 12:26 PM, Abhijit Bare wrote:

> I have a problem with tshark memory usage. I need to use tshark for a read filter. However, it looks like tshark 
> reads in the entire input file in memory. Is this correct?

No, it is not.  Neither Wireshark nor TShark read the entire input file into memory.

When it reassembles fragmented/segmented/etc. packets, however, the content of the reassembled packets *is* kept in 
memory.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe