Watersrc-stack/NetOtter
1
0
Fork 0
Code Issues Projects Releases 7 Packages Wiki Activity
Page: Memory and Limits
Pages
Analysis View Anomaly Detection Anomaly Lab Architecture Building Coding Conventions Command Line Options DNS Developer Guide Display Filters Ethernet Filters and Analysis Internals Function Explorer Functions Analysis Functions Anomaly detection Functions Display Functions Entry point Functions Filters Functions Interactive commands Functions Linux backend Functions Packet helpers Functions Parsers Functions Save files Functions Utils Functions Windows backend Getting Started Home Hostname Learning IPv4 IPv6 Installation Interactive Commands Learning Memory and Limits OS Backends Packet Parsing Packet Storage QUIC Reverse DNS Internals Reverse DNS and Privacy Save Files Save Format TCP Traffic Anomalies Troubleshooting UDP User Guide
1 Memory and Limits
Watersrc-stack edited this page 2026-10-11 14:31:31 +02:00
Table of Contents

Memory and limits

NetOtter keeps every packet it captures, so that i, filters and saves can reach all of them. To keep long sessions small, it doesn't keep the packets' contents in RAM.

Where packets go

  • Headers stay in RAM, decoded: about 320 bytes per packet for a UDP/IPv4 packet.
  • Payloads (everything after the IP header) are compressed one by one, then written to a temporary file, the spool. When compression doesn't help (encrypted traffic like HTTPS or QUIC never compresses), the bytes are stored as they are.

NetOtter announces the spool when it starts:

Payloads are kept compressed in a temporary file in /home/you/.cache/netotter/ (deleted on exit)

The spool lives in NetOtter's cache folder (~/.cache/netotter/ on Linux, %LOCALAPPDATA%\NetOtter\ on Windows), not in /tmp, which is often in RAM. It has no name and the system deletes it when NetOtter exits, even after a crash on Linux. If it can't be created, payloads stay in RAM, compressed.

Plain-text payloads shrink to about 55% of their size. i decompresses the one packet it shows. Saving copies the stored bytes as they are, without decompressing them.

The RAM budget

The decoded packets may use up to 2 GiB of RAM. When the next packet would go past it, NetOtter:

  1. stops every interface and prints an alert, in bold red when the terminal shows colours, in capitals otherwise:

    Capture stopped: the packet list reached its memory limit (2048 MiB). Save it (O / o, or -O at exit) and start a new capture.

  2. refuses to start an interface again (The packet list is full (2048 MiB): no interface can be started. Save it and start a new capture.).

  3. in CLI mode, stops as on Ctrl-C: it prints the list and saves with -O / -o.

A file bigger than the budget loads up to it, with Only part of the file was loaded: the packet list reached its memory limit (2048 MiB). Nothing more can be captured.

Other limits

What Limit
Packet ids i accepts up to 999,999,999
Frames read per interface per tick 500 (a tick is every 250 ms)
Hostnames learned 2,048; past that, the oldest learned name is forgotten
Reverse DNS answers kept 65,536
Reverse DNS queries 16 sent per tick, 64 waiting at most, 5 s timeout
Reverse DNS log (D) the last 10,000 events
Packet payload 65,535 bytes
Interface names 15 characters

NetOtter

User guide

Developer documentation

Learning