Re: [Wireshark-dev] nmake problem (cl.exe)

2010-11-03 Thread Lange Jan-Erik
Yes, there are a few people who have this problem too. There is a way to solve this problem. You have to unregister the microsoft installer, reboo´t the pc and register it after that. If this action doesn't solve the problem there is a second way. I tried both ways and but reached no

Re: [Wireshark-dev] Spurious TCP SEQ/ACK analysis errors

2010-11-03 Thread Graham Bloice
On 02/11/2010 18:08, Christopher Maynard wrote: Graham Bloice graham.blo...@... writes: Are folks seeing a lot of these on trunk? Almost every capture I load seems to have some TCP ACKed lost segment and TCP Previous segment lost warnings, even though the

Re: [Wireshark-dev] question about option82

2010-11-03 Thread Jaap Keuter
On Wed, 3 Nov 2010 06:25:33 +0100, Guo, Fei wrote: Hi All, I capture a option82 packet with wireshark, but it is displayed with malformed. and I check the code, the following in function bootp_dhcp_decode_agent_info.

Re: [Wireshark-dev] nmake problem (cl.exe)

2010-11-03 Thread Christopher Maynard
Lange Jan-Erik jan-erik.la...@... writes: Ok, I'll ask somewhere else. Well the error message does indicate, Contacte your support personel for assistance., so maybe your own internal helpdesk/IT gurus could help you? ___

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Anders Broman
Hi, Looking more closly at the reassembly code the best solution may be to save the reasembled data To a new temp file at the first pass and read from that file when the reassembled data is needed again. Possibly by attaching the file offset pointer to per packet data or in the reassembled

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jakub Zawadzki
Hi, On Wed, Nov 03, 2010 at 04:24:21PM +0100, Anders Broman wrote: Looking more closly at the reassembly code the best solution may be to save the reasembled data To a new temp file at the first pass and read from that file when the reassembled data is needed again. Possibly by attaching

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Guy Harris
On Nov 3, 2010, at 11:25 AM, Jakub Zawadzki wrote: Temp files are also kind of memory, so you won't decrease memory by using them : That depends on what type of memory you're talking about. If you're talking about the address space of Wireshark - which, at least for 32-bit versions of

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jeff Morriss
Jakub Zawadzki wrote: Hi, On Wed, Nov 03, 2010 at 04:24:21PM +0100, Anders Broman wrote: Looking more closly at the reassembly code the best solution may be to save the reasembled data To a new temp file at the first pass and read from that file when the reassembled data is needed again.

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jeff Morriss
Guy Harris wrote: On Nov 3, 2010, at 11:25 AM, Jakub Zawadzki wrote: Btw. it's like reinventing swap, so if you want to use your disk as memory, it's enough to create some big file and do mkswap swapon. (Well maybe on 32-bit systems it's not so easy...) Yes - adding swap space (which

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jakub Zawadzki
On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote: I like Jeff Moriss idea about mmap()ed files. ...which consume address space, so, again, if the problem is running out of address space, rather than running out of main memory+backing store for anonymous pages, that won't help.

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Anders Broman
Jakub Zawadzki skrev 2010-11-03 20:48: On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote: I like Jeff Moriss idea about mmap()ed files. ...which consume address space, so, again, if the problem is running out of address space, rather than running out of main memory+backing store for

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jakub Zawadzki
On Wed, Nov 03, 2010 at 03:00:10PM -0400, Jeff Morriss wrote: Memory mapped files count as part of the process' address space so mapping the capture file means that, for reassembly, we'd be trading malloc'd memory for mmap()'d memory *and* it would mean we're holding the whole

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jeff Morriss
Jakub Zawadzki wrote: On Wed, Nov 03, 2010 at 03:00:10PM -0400, Jeff Morriss wrote: Memory mapped files count as part of the process' address space so mapping the capture file means that, for reassembly, we'd be trading malloc'd memory for mmap()'d memory *and* it would mean we're holding

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jeff Morriss
Anders Broman wrote: Jakub Zawadzki skrev 2010-11-03 20:48: On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote: I like Jeff Moriss idea about mmap()ed files. ...which consume address space, so, again, if the problem is running out of address space, rather than running out of main

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Guy Harris
On Nov 3, 2010, at 1:28 PM, Jakub Zawadzki wrote: Still it's lot easier to work with than fread() + fseek() ...as long as you're in a situation where you won't get any I/O errors, including errors due to timeouts on file servers if the capture file is on a server or due to an external hard

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Guy Harris
On Nov 3, 2010, at 2:48 PM, Jeff Morriss wrote: Jakub Zawadzki wrote: Well I'm not expert in mmap()'ed files, but afair they won't be read until page fault, They may not be loaded into memory, but AFAIK the mapped memory will immediately count towards the process' (used) address

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jeff Morriss
Jakub Zawadzki wrote: On Wed, Nov 03, 2010 at 11:50:58AM -0700, Guy Harris wrote: I like Jeff Moriss idea about mmap()ed files. ...which consume address space, so, again, if the problem is running out of address space, rather than running out of main memory+backing store for anonymous pages,

Re: [Wireshark-dev] Reduce memory consumption by re-reading data from file for reassembled packets.

2010-11-03 Thread Jakub Zawadzki
On Wed, Nov 03, 2010 at 05:48:13PM -0400, Jeff Morriss wrote: REMOVE would mean unmap the memory We really don't want to use MADV_REMOVE (even on Linux) #v+ Application wants to free up the pages and *associated backing store.* *This is effectively punching a hole into the middle of a

Re: [Wireshark-dev] question about option82

2010-11-03 Thread Guo, Fei
sorry, I only check the latest 1.2.12 version. thank you very much. WIND RIVER | China Development Center Tel: 86-10-8477-8665 | Fax: 86-10-64790367 From: wireshark-dev-boun...@wireshark.org [mailto:wireshark-dev-boun...@wireshark.org] On Behalf Of Jaap

[Wireshark-dev] Announcing sharktools: matshark and pyshark

2010-11-03 Thread Babikyan, Armen - 0663 - MITLL
Hello, [Sorry for the cross-post, but I feel this announcement is relevant to both Wireshark users and Wireshark developers] I'd like to announce the GPLv2 public release of matshark and pyshark - collectively sharktools - to the Wireshark community. Matshark and Pyshark are tools that