Open poleguy opened 2 years ago
Hi @poleguy, I'm also experiencing this issue, do you have any solution? workaround?
Thanks
I have no solution. However I used a workaround: I manually 'tail' the pcapng file:
I start a copture to pcapng on disk. In another process I open the pcapng using python and read packets until the very end of the file. I don't use a library to do this, I just decode the pcapng format directly. I keep track of the byte offset of the last packet read. Then I close the file. After a second I re-open the file, start at the byte offset where I left off and continue processing. Using the process I can close everything and ensure no memory leaks. It works reliably for live visualization of the data in the tail of the pcapng file.
Describe the bug Pyshark if used repeatedly leaves open files (pipes?) and crashes within minutes. I have a complex use-case, but I have simplified it down to a minimally reproducible example, included below. My need is (roughly) to capture the 20 most recent packets coming from the interface, display a visualization of them to the user and then grab the next 20 most recent packets. Ideally this could be done without dropping any packets, but it needs to be the most recent 20 packets, so it must be set up to drop packets gracefully if necessary to not have stale data after grabbing the most recent 20 contiguous packets.
To Reproduce Steps to reproduce the behavior: Run this code:
Expected behavior It should run for days, weeks, years.
Versions (please complete the following information):
Example pcap / packet This is in a live capture use case, so there are packets continuously arriving. I don't think it matters what these packets are.