Understanding how a Probe Uses RAM | 67
Chapter 13: Understanding
how a Probe Uses RAM
How a probe uses RAM
A Windows computer uses Random Access Memory (RAM) as a form of temporary data storage. Windows
separates all available memory into three sections: protected memory, user memory, and reserved memory. An
Observer probe, depending on how it is configured, uses these types of memory differently.
The
protected memory
is used to load critical operating system files, such as device drivers. If any of this RAM is
dedicated to a driver or some other critical file, it cannot be used by another program. However, after Windows
finishes loading its drivers, the memory is freed and any program may access the remaining protected memory.
User memory
is all available memory beyond the protected memory. It is available to any application at any time.
The probe uses this memory to temporarily store statistical information, such as Top Talkers data.
Reserved memory
is user memory that you have specifically set aside for use by the Observer probe. Only the
probe may use that portion of RAM. When the RAM is reserved for the probe not even the operating system may
access it—even when Observer is closed.
By having RAM reserved specifically for the Observer probe, you ensure that the probe has the memory
necessary to capture packets and store these packets for statistical processing. If Observer runs without any
reserved memory, it requests and uses the operating system’s protected memory for capturing packets. There is
no adverse effect of running an Observer probe without reserved memory, but it is not the most efficient way to
run the probe. By default, the probe uses no reserved memory. Our recommendation is that you reserve memory
for Observer so that the probe runs efficiently and leaves the protected memory for the operating system and
other programs to use.
Packet captures are always written sequentially from the first open byte of RAM in reserved memory or in
Windowsprotected memory. They are written until all available space is used. If you are using a circular buffer,
then the first packet is overwritten with the newest packet. This is first-in, first out (FIFO). With Windows
protected memory, your capture space is limited to about 50 to 80 MB, but with reserved memory you have
the potential to store many gigabytes in memory.
describes the two different ways that
Observer runs.
