Reduce memory footprint

Reduce memory footprint

Wireshark uses a lot of memory to keep state do reasembly and whatever possibly not always in the most efficent maner. Collect ideas the might be worth exploring here.

Find the stuff that uses up the memory

Today we think that the packet list, the reassembly functions the frame data and address resolution stuff are the main memory hogs. But do we know for sure?

GUI code to show actual memory usage

In ui/gtk/memory_dlg.c we have the beggining of code showing the actual memory usage perhaps that should be expanded.

Address resolution

Address resolution consumes memory even when addreses isn't resolved as the IP address string is cashed. It's supposed to save memory for the packet list but I'm not sure if it works as intended. Should be reviewed.

Reasembled data

Reasembled data is keept in memory. If it was saved on file instead it would save a lot of memory but might cost more in terms of time. Follow TCP stream does a better job of handling out of order packets so writing to file might have other benefits as well.

Imported from on 2020-08-11 23:23:52 UTC