Re: Reduce memory consumption by re-reading data from file for reassembled packets.

[Jakub Zawadzki <darkjames () darkjames ath cx>]

Hi,

On Wed, Nov 03, 2010 at 04:24:21PM +0100, Anders Broman wrote:
> Looking more closly at the reassembly code the best solution may be to save the reasembled data
> To a new temp file at the first pass and read from that file when the reassembled data is needed again.
> Possibly by attaching the file offset pointer to per packet data or in the reassembled hash table.
> Ultemately it would be nice to store this data in the libpcap file and have it available the next time the file
> Is opened.
>
> Does any one see any problems with having a temp file with reassembled PDU:s? I suppose this file can become
> Almost as big as the original trace file.

Temp files are also kind of memory, so you won't decrease memory by using them :>
Btw. it's like reinventing swap, so if you want to use your disk as memory,
it's enough to create some big file and do mkswap & swapon.
(Well maybe on 32-bit systems it's not so easy...)

I like Jeff Moriss idea about mmap()ed files.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe