1

I read a .pcap file in python using pyshark. If I read the file multiple times, it seems that pyshark doesn't free resources. The resources are freed only when I close the python program.

import pyshark

def foo():
  for i in range(100):
      p = pyshark.FileCapture('/tmp/tmp.pcap')
  return

foo()
sleep(100)

Before the program starts

konstantin@linux-ks:~/Programs/skype-4.3.0.37> cat /proc/net/sockstat
sockets: used 945
TCP: inuse 12 orphan 0 tw 0 alloc 24 mem 0
UDP: inuse 14 mem 4

When the program runs

konstantin@linux-ks:~/Programs/skype-4.3.0.37> cat /proc/net/sockstat
sockets: used 1154
TCP: inuse 12 orphan 0 tw 0 alloc 24 mem 1
UDP: inuse 14 mem 4

The only way I found to mitigate the problem isn't crisp - simply increase the open file limit in the system so the limit is hardly reached.

/etc/security/limits.conf:

*               soft    nofile            10000
*               hard    nofile            10000

Could you help me to understand the reason of such puzzling behavior? I suppose that pyshark or some package that pyshark uses open some file but doesn't close it properly.

Konstantin
  • 2,937
  • 10
  • 41
  • 58
  • 1
    Try using p.close() explicitly, though it should be called on garbage collection. Also check that you're using the latest version. It could be that tshark (which pyshark uses) isn't closed properly for some reason. – KimiNewt Jul 22 '17 at 06:58

0 Answers0