How Packet Capture Affects Ram - Network Instruments GigaStor User Manual

1)
Because of how 64-bit Windows loads its drivers when 4 GB of RAM is installed all 4 GB is used by Windows. This is
sometimes referred to as the BIOS memory hole and means you cannot reserve any memory for Observer. To capture packets
on 64-bit Windows install either more than or less than 4 GB of RAM.
2)
32-bit operating systems do not support more than 4 GB of RAM. Observer cannot use any RAM above 4 GB.
1. To see how much protected memory the probe has, click the Memory Management tab.
2. Click the Configure Memory button at the top of the window to view and modify how Observer uses the
protected memory for this probe instance. The Edit Probe Instance window opens.
On the Edit Probe Instance window, you can see how memory is allocated for:
Packet capture
Statistics queue buffer
You can also see how much protected memory is still available in the Windows memory pool.
3. Use the arrows to the right of the Packet capture and Statistics queue buffer to increase or decrease the
amount of RAM you want dedicated to each. See
to divide the memory.
4. Click View to see the different types of networks and how the memory is allocated to the numerous statistics
collected by Observer. See
why you may want to change some allocations.
5. After reserving memory for Observer you must restart the system for the changes to take affect. After you
restart the system you can allocate the memory to the different probe instances.

How packet capture affects RAM

When you start a packet capture (Capture > Packet Capture and click Start), all packets that Observer sees are
placed into the packet capture buffer (a specific portion of the protected memory). The packets stay in this
protected memory until the buffer is cleared. If you are using a circular packet buffer, new packets overwrite old
ones after the buffer is full.
Figure 17 (page 73) shows how Observer receives a packet and distributes it throughout RAM, and how it is
written to disk for packet capture and GigaStor capture.
Packets received by the network card are passed to Observer, where Observer puts each packet into RAM,
specifically in the packet capture memory buffer and the statistical queue buffer. If a packet must be written to
disk for either a GigaStor capture or a Packet Capture, it is copied from the RAM and written to the disk.
72 | GigaStor™ (pub. 25.Apr.2014)
How to allocate the reserved RAM
Tweaking the statistics memory configuration
to help determine how
for details about the window and