Home page logo

wireshark logo Wireshark mailing list archives

Re: Memory consumption in tshark
From: Dario Lombardo <dario.lombardo.ml () gmail com>
Date: Wed, 28 Aug 2013 15:31:31 +0200

On Wed, Aug 28, 2013 at 1:29 PM, Evan Huus <eapache () gmail com> wrote:

It's dependant on platform and setup, but I'll assume a from-source build
on Linux. In theory all you have to do is prefix your normal command with
"libtool --mode=execute valgrind --tool=massif" and then the usual ./tshark

Valgrind takes a bunch more memory though, so you'll almost certainly want
to use editcap to split the capture, and then run this on just a subset.

It will produce an output file massif.out.PID which you can pass to the
ms_print command for human-readable output. That output would be useful to

I'm attaching the output. I've run it on a 1GB pcap file.

Attachment: massif.out.6312.txt

Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]