Guy Harris wrote: > The problem is, I suspect, that the new code for attaching window > scaling option information to a conversation is used regardless of > whether TCP sequence analysis is enabled, and that code calls > "get_tcp_conversation_data()", which assumes that "tcp_analysis_chunk" > is non-NULL, but that memory chunk is allocated only if TCP sequence > analysis is enabled. >
Yes, you are probably right. I have now turned on the "Analyze TCP Sequence numbers" and "Relative Seq nums and Window Scaling" options as a temporar fix and then I don't get a crash with the same captures. I didn't have Window Scaling turned on when I got the crash, but it seems that that routine was called anyway.
