Sniffer 4.7 and memory issue

[fortunat]

I just removed Sniffer 4.5 and installed 4.7 along with the new card drivers for my Xircom.

When I start a capture I get the following warning:

"The size of buffer memory is more than half of available physical memory. This may cause slow application performance and may drop frames."

I have 128 Mb of RAM on a 500 Mhz Sony Laptop with WIN98se.
I have also tested this on my 600 Mhz Toshiba Laptop with 128 Mb of RAM with WIN98se without an issue.

Anybody got any tips to help me out. I am also going to open a ticket with NAI and will post my results.

Regards

 

[douglas767]

Hi,

I have some tips for you:

1) Set the size of pagefile for a minimum of a double of fisical memory you have. If you need a help, try using a software named x-tech, it's ease.

2)Enable the second level data cache (the x-tech can help with this too.

3)I'm not sure but I belive the problem you have is related to the capture buffer declared in the buffer section of filter definitions.

luck

Douglas

 

[fortunat]

Can't find the x-tech software you mentioned. Please pass on the URL, Regards

 

[cpete]

I don't understand your problem. With 4.7, the capture buffer size was increased beyond 64M. With very large capture files, perfomance is more of an issue, hence the warning message you encountered. What size capture buffer are you attempting to set? I didn't see you mention it. You might get better results with NT or W2K. Is there a reason you have to use W98SE?

Chris

 

[fortunat]

Hi Chris,
- My capture buffer is set to 8MB.
- I use win98se since I work with dial up baselining, etc..

 

[cpete]

OK, I get it now. Yes, it sounds like a bug. You shouldn't be seeing that message with a 8MB buffer.

Chris

 

[fortunat]

Alrighty then, I feel better.. I thought I was losing my already aging mind.

Thnaks for the feedback..

 

[NetworkUptime]

It is very possible that you will see this error message with only 128MB of memory in your Sniffer Portable computer, especially with other programs running simultaneously (virus scanner, video management applications, messaging programs). The Sniffer message is:

"The size of buffer memory is more than half of available physical memory. This may cause slow application performance and may drop frames."

The keywords in the error message are "available physical memory." This isn't referring to the amount of total memory in the computer, it's referring to the total _available_ physical memory when you begin to capture network traffic.

In Windows NT/2000, you can view available physical memory from the Task Manager. In Windows 98, use System Monitor (if you haven't used System Monitor or don't have it installed, use Windows Help to walk you through the process).

In Windows 98 System Monitor, track Memory Manager/Unused Physical Memory. To capture an 8MB capture file, you must have at least 16MB of unused physical memory available when you begin capturing.

128MB of system RAM is the minimum recommended memory size, according to the Sniffer Portable documentation. If you're planning to do any intense network analysis, or want to run other processes simultaneously, you'll want to upgrade your RAM!

I don't pretend to understand the details of Windows memory management, but there are plenty of articles on MSDN:

http://msdn.microsoft.com/library/en-us/dngenlib/html/msdn_heapmm.asp

 

[fortunat]

Thnaks for the last bit of info. I never thought to check that out via the System Tools.

My memory drops to 4 MB as the sniffer is running/capturing.

Maybe I will upgrade my memory.. 'Making things work better; bit by bit.'

 

[douglas767]

Dear Fortunat,

Sorry about my fault, the url for the xteq is:

http://www.xteq.com,

or if you like try on

http://www.cnet.com

"search field"

At your disposal,


Douglas

 

[fortunat]

Indeed 4.7 is very picky about its memory usage. I cleaned up everything from my startup and system tray. After two captures, I was again out of memory.

I basically gave up and reinstalled my 4.5.

Thanks for all your assistance. 'Making things work better; bit by bit.'