Is the pkt_data occupies memory continuously? - wireshark

I am developing sniffer using WinPcap. As am running application continuously, after 6 hours RAM is becoming full and it is not responding. why the memory increasing continuously?
Is const u_char* pkt_data is occupies memory each time?
Which variable is occupying memory continuously in Pcap API's? if so how to free the memory?

Is const u_char* pkt_data is occupies memory each time?
No. The memory pointed to by pkt_data is not guaranteed to remain allocated after your callback routine returns (if you're using pcap_loop() or pcap_dispatch()) or after the next call to pcap_next() or pcap_next_ex(). In WinPcap, there's a fixed-size circular buffer into which packets are placed in the kernel, and those are read into a single fixed-size buffer in the library.
Which variable is occupying memory continuously in Pcap API's?
None. As nos indicates, it's probably a memory leak in your program.

Related

Are there fixed memory allocated for Stack and Heap?

I understand the fact that stack grows upwards and heap grows downwards or vice-versa (architecture dependent).
But, i couldn't find much details about how actually it's implemented, my doubt is, for every process a memory block will be allocated, but is there a restriction on, how much max chunk can be used for stack or heap? Or are there no restrictions till whole allocated memory is consumed?
Yes, processes have predetermined stack sizes. Have you ever tried to recurse a method/function too much? You get a StackOverflow exception. That doesn't mean you've already went through your entire computer's memory. The OS controls distribution of stack and heap memory for each process.

overall bytes in Xcode Instruments reaches 1 GB is that ok?

Here is my question.
I tried to check my allocation part using Instruments in xcode.
I am doing some image crop Application using CGImageSourceCreateThumbnailAtIndex for processing the images. while doing the process it is taking to much memory and i released it in right manner.
In Instruments the live bytes is 1.56Mb , #living = 22,862 and Overall bytes reaches 1.11Gb after that also it will increase.
This application is not working in ipad1. i dont have ipad2 or 3 in hand to test the application.
In the image some peak points are there. At that point Live Bytes reaches 73MB. and it will be released. will ipad 2 handle this peak ??
Can anyone tell this will cause any memory Problem in device.
How about the overall bytes. is there any limit for this?
yes since overall bytes is just the number of bytes that were EVER allocated.
The longer the app runs, the higher the no.

Unreasonable Heap Growth

Hi I have truble with allocated memory, because I noticed in Instruments a lot of Heap Growth, so I designed a test app.
Test app contained two ViewControllers and each have one button.
First ViewController was linked thru Segue Modal to SecondViewController (and it has NO code at all - beside auto-generated).
Second ViewController has only function
-(IBAction)back:(id)sender{
[self dismissModalViewControllerAnimated:YES];
}
so I could flip throw views.
When I test it whit Instrument I noticed heap growth after I go to second view and back.
How is that posible? What am I missing?
The size of the heap is not the app memory usage.
When your app is alive, the kernel will have to allocate memory for you.
Modern systems uses virtual memory. Basically, they map physical addresses to virtual addresses, that your process will access.
This mapping is handled by the kernel, and it needs memory for it.
If you request 1MB of memory, it will have to allocate memory to keep track of the physical pages allocated, by increasing the size of your adress space.
If you free all memory, the kernel will usually keep the memory used for the mapping, and re-use it for the next allocations, avoiding the need to reallocate space for it.
This is why the heap size doesn't change. But it does not indicate your application's memory usage at all.
If using Instruments, look at the VM Tracker tool for this.

Why does the stack overflow?

Ok. so my understanding of how executables are laid out in memory is... image a square box that represents the memory accessible by your app.
The program code resides at the bottom of the memory, the stack is allocated to a spot just beyond the program code and is allocated upwards. the heap starts at the top of the memory and is allocated downwards.
If this is the case, why is it possible to allocate more heap memory than stack memory?
Because even on modern systems with lots of virtual memory available, the maximum size of the call stack is usually deliberately limited to, say, 1MB.
This is not usually a fundamental limit; it's possible to modify this (using e.g. setrlimit() in Linux, or the -Xss flag for Java). But needing to do so usually indicates an abnormal program; if you have large data-sets, they should normally be stored on the heap.

memory allocation in small memory devices

Some systems such as Symbian insist people to use heap instead of stack when allocating
big objects(such as pathnames, which may be more than 512 bytes). Is there any specific reason for this?
Generally the stack on an embedded device is fixed to be quite small i.e. 8K is the default stack size on Symbian.
If you consider a maximum length filename is 256bytes, but double that for unicode that's 512bytes already (1/16th of your whole stack) just for 1 filename. So you can imagine that it is quite easy to use up the stack if you're not careful.
Most Symbian devices do come with an MMU, but, until very recently, do not support paging. This means that physical RAM is committed for every running process. Each thread on Symbian has (usually) a fixed 8KB stack. If each thread has a stack, then increasing the size of this stack from 8KB to, say 32KB, would have a large impact on the memory requirements of the device.
The heap is global. Increasing its size, if you need to do so, has far less impact. So, on Symbian, the stack is for small data items only - allocate larger ones from the heap.
Embedded devices often have a fixed-sized stack. Since a subroutine call in C only needs to push a few words onto the stack, a few hundred byte may suffice (if you avoid recursive function calls).
Most embedded devices doesn't come with a memory management unit so there is no way for the OS to grow the stack space automatically, transparent to the programmer. Even assuming a growable stack, you will have to manage it yourself which is no better than heap allocation and defeats the purpose of using a stack in the first place.
The stack for embedded devices usually resides in a very small amount of high-speed memory. If you allocate large objects on the stack on such a device, you might be facing a stack overflow.

Resources