Reduce memory footprint

Wireshark uses a lot of memory to keep state for reassembly, and data that is not always in the most efficient manner. Collect ideas that might be worth exploring here.

Find the stuff that uses up the memory

Today we think that the packet list, the reassembly functions, the frame data, and address resolution stuff are the main memory hogs. But do we know for sure?

GUI code to show actual memory usage

In ui/gtk/memory_dlg.c, we have the beginning of code showing the actual memory usage; perhaps this should be expanded.

• Show wmem allocation
• Design a registration function to register g_hash_table callbacks with hash table names, approximate memory usage per entry. This would make it possible to get the number of entries in the hash table and calculate a rough estimate of the memory consumed by it.

Address resolution

Address resolution consumes memory even when addresses are not resolved, as the IP address string is cached. It's supposed to save memory for the packet list, but I'm not sure if it works as intended. Should be reviewed.

Reassembled data

Reassembled data is kept in memory. If it was saved on file instead, it would save a lot of memory but might cost more in terms of time. Follow TCP Stream does a better job of handling out-of-order packets, so writing to file might have other benefits as well.

• Write a tmp file with a "block" per reasmbled fragments and just keep a file pointer and length indicator in the table, much like current fdata?
• Write a new file as we are reading in the original one and write the reasembled data in the block with the final fragment as a new pcapng option. Fragment Blocks needs to have a flag reasembled set. When first pass is made switch to the new file. The new file should be possible to save and use as a "pre reasembled file"
  • Will this work for live captures?
  • If we have a "reassembled file" where reasembly didn't work properly, can we reset and retry?