Chris and Jaap Well.... I guess I can point out the obvious here:
I wrote a dissector that works fine with the GUI with no problem...but it crashes when I use tshark. HOWEVER... if I remove my dissector....then my pcap file loads fine within tshark. So the problem has to be with my dissector....correct..?? Is there anyway I can post my code so you can take a look..?? This is hard to track down as again everything works fine in the GUI and I get NO real error message within tshark. What do you think..? Thanks, Brian Maynard, Chris wrote: > The file may not be corrupt but might contain packet(s) which are > exposing a tshark bug. If you can post the capture file, that would > probably help. If you don't wish to post it on the mailing list, you > can open a bug report and post it there instead, marking the file as > private if you so desire so only the core developers have access to it. > > - Chris > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Brian Oleksa > Sent: Monday, November 23, 2009 12:59 PM > To: Developer support list for Wireshark > Subject: Re: [Wireshark-dev] wireshark GUI vs tshark > > Jaap and Chris > > I am running this on Win XP service pack 2. > I am using wireshark Version 1.2.4 (SVN Rev 30978). > > The test.pcap file has been around for a while...so chances are it is > not corrupt. It never crashes using the GUI...it just crashes and gives > me that pop up when I run it with that tshark command. > > This is about all the information that I can provide....unless you can > think of something else that you need..?? > > Thanks, > Brian > > > Jaap Keuter wrote: > >> Hi Brian, >> >> Thanks for including the error report. It in itself doesn't tell >> > anything, > >> other than that a problem was detected. That's why Chris asked you >> > some > >> more questions on the whole situation. Maybe we can help you further >> > when > >> you look into them. >> >> Thanks, >> Jaap >> >> On Mon, 23 Nov 2009 12:02:17 -0500, Brian Oleksa >> <[email protected]> wrote: >> >> >>> Chris >>> >>> I have attached the error this time....sorry about that. :-) >>> >>> I get this error when I run with tshark using the following command: >>> >>> tshark -nr test.pcap ip.dst==x.x.x.x >>> >>> But when I filter in the GUI ... I have no problems. >>> >>> Thanks, >>> Brian >>> >>> >>> >>> >>> >>> Maynard, Chris wrote: >>> >>> >>>>> Any thoughts..?? >>>>> >>>>> >>>>> >>>> My first thought was, "I guess you forgot to include the error." :) >>>> >>>> In addition to the error, you might want to include some Wireshark >>>> version information, what OS you're running on and any other >>>> >>>> >> information >> >> >>>> that you think might be relevant. >>>> >>>> By the way, I tried a similar tshark command using Wireshark 1.2.4 >>>> > on > >>>> Windows XP SP3 with no problems. Maybe you are running an older >>>> >>>> >> version >> >> >>>> of Wireshark with a known bug that has been fixed, or maybe your >>>> test.pcap file is corrupt or exposes a Wireshark bug, in which case >>>> > a > >>>> bug report might be in order with the attached test.pcap file >>>> > included > >>>> so the core developers can analyze the error and find & fix the bug. >>>> >>>> - Chris >>>> >>>> -----Original Message----- >>>> From: [email protected] >>>> [mailto:[email protected]] On Behalf Of Brian >>>> > Oleksa > >>>> Sent: Sunday, November 22, 2009 10:49 PM >>>> To: Developer support list for Wireshark >>>> Subject: [Wireshark-dev] wireshark GUI vs tshark >>>> >>>> >>>> Wiresharkers >>>> >>>> When I use my dissector with the GUI... everything works fine. The >>>> > pcap > >>>> >>>> >> >> >>>> file that I load comes right up with NO problems. I can filter >>>> (ip.dst==x.x.x.x) with no problems. >>>> >>>> But if I try to open that same pcap file with tshark using the >>>> >>>> >> following >> >> >>>> command: >>>> >>>> tshark -nr test.pcap ip.dst==x.x.x.x >>>> >>>> The files appears to start loading.. then I get the following error. >>>> >>>> Any thoughts..?? >>>> >>>> Thanks, >>>> Brian >>>> CONFIDENTIALITY NOTICE: The contents of this email are confidential >>>> and for the exclusive use of the intended recipient. If you receive >>>> >>>> >> this >> >> >>>> email in error, please delete it from your system immediately and >>>> notify us either by email, telephone or fax. You should not copy, >>>> forward, or otherwise disclose the content of the email. >>>> >>>> >>>> >>>> > ________________________________________________________________________ > ___ > >> >> >>>> Sent via: Wireshark-dev mailing list >>>> > <[email protected]> > >>>> Archives: http://www.wireshark.org/lists/wireshark-dev >>>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev >>>> >>>> >>>> >> mailto:[email protected]?subject=unsubscribe >> >> >> > ________________________________________________________________________ > ___ > >> Sent via: Wireshark-dev mailing list <[email protected]> >> Archives: http://www.wireshark.org/lists/wireshark-dev >> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev >> >> > mailto:[email protected]?subject=unsubscribe > >> >> > ________________________________________________________________________ > ___ > Sent via: Wireshark-dev mailing list <[email protected]> > Archives: http://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev > > mailto:[email protected]?subject=unsubscribe > CONFIDENTIALITY NOTICE: The contents of this email are confidential > and for the exclusive use of the intended recipient. If you receive this > email in error, please delete it from your system immediately and > notify us either by email, telephone or fax. You should not copy, > forward, or otherwise disclose the content of the email. > > ___________________________________________________________________________ > Sent via: Wireshark-dev mailing list <[email protected]> > Archives: http://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev > mailto:[email protected]?subject=unsubscribe > ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
