altafinance / ushark Goto Github PK

I'm having a memory leak when modifying the real-time traffic that ushark uses to parse fetched from the network device:

1. First, modify the pcap_open_offline function in cap_example.c to pcap_open_live to listen for the traffic of a network device.
2. Then run the program, use the atop -m command to observe the change of the memory occupation of the program, and find that the memory occupation is increasing.
3. When I gave the memory leak analysis report with valgrind --tool=memcheck --leak-check=yes --show-reachable=yes --trace-children=yes --log-file=leak.txt -v ./test gave the memory leak analysis report and found that there was no definitely lost.
4. When I put memcpy(ws_buffer_start_ptr(buf), sk->dissect.pkt, len); changed to memcpy(ws_buffer_start_ptr(buf), "", len); When testing, the memory leak problem disappeared, so it can be judged that it is a problem with BUF. When I tried to add the processing logic for bufws_buffer_free(&buf); There is no improvement either.
5. I don't know if it has anything to do with libpcap library, I hope to get your help, thank you!

Do you have an example of dfilter?

Is it possible to force Dissector to decode RTP packets more accurately?
Often it decodes them as "data" (raw) packets instead of RTP