Re: TShark Error

[Forthofer Russ <Russ.Forthofer () ssfhs org>]

How big is your input file?   Have you tried running tshark against a small file - or a subset of your input file? For 
example, use editcap to reduce the size of the file to just a few frames and run the command again.    I just ran a 
similar command (with a 160M file) and had no problem.

Can you run tshark with no parameters? 

Also - this may be a silly question, but.... your path shows forward slashes rather than MS backslashes, but says it is 
running under Windows XP.    What environment are you actually in?  I may just be mis-reading the mail.

Russ

-----Original Message-----
From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Robert D. 
Scott
Sent: Tuesday, March 16, 2010 3:15 PM
To: 'Community support list for Wireshark'
Subject: Re: [Wireshark-users] TShark Error

1.2.6 exhibits the same issue. :(    Memory?

robert@Robert /cygdrive/c/3Com/ftp
$ /cygdrive/c/Program\ Files/Wireshark/tshark -r tcpdump.fsn1-114.pcap -R "ip.addr == 128.227.74.
45" -w tcpdump.fsn1-114-filt.pcap
Unhandled exception (group=1, code=6)

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.

robert@Robert /cygdrive/c/3Com/ftp
$ /cygdrive/c/Program\ Files/Wireshark/tshark -v TShark 1.2.6 (SVN Rev 31702)

Copyright 1998-2010 Gerald Combs <gerald () wireshark org> and contributors.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or 
FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.22.3, with WinPcap (version unknown), with libz 1.2.3, without POSIX capabilities, without 
libpcre, with SMI 0.4.8, with c-ares 1.7.0, with Lua 5.1, with GnuTLS 2.8.5, with Gcrypt 1.4.5, with MIT Kerberos, with 
GeoIP.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.1 (packet.dll version 4.1.0.1753), based on 
libpcap version 1.0 branch 1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5.

Built using Microsoft Visual C++ 9.0 build 30729

Robert D. Scott                 Robert () ufl edu
Senior Network Engineer         352-273-0113 Phone
CNS - Network Services          352-392-2061 CNS Phone Tree
University of Florida           352-392-9440 FAX
Florida Lambda Rail             352-294-3571 FLR NOC
Gainesville, FL  32611          321-663-0421 Cell

-----Original Message-----
From: wireshark-users-bounces () wireshark org
[mailto:wireshark-users-bounces () wireshark org] On Behalf Of Anders Broman
Sent: Tuesday, March 16, 2010 11:40 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] TShark Error

Hi,
Any particular reason for not using 1.2.6 or 1.0.11?
1.2.6 should contain the most fixes.

Regards
Anders
________________________________________
From: wireshark-users-bounces () wireshark org
[wireshark-users-bounces () wireshark org] On Behalf Of Robert D. Scott [robert () ufl edu]
Sent: Tuesday, March 16, 2010 4:08 PM
To: 'Community support list for Wireshark'
Subject: [Wireshark-users] TShark Error

Any pointers?  I have two different files that throw the same error?

robert@Robert /cygdrive/c/3Com/ftp
$ tshark -r tcpdump.fsn1-114.pcap -R "ip.addr == 128.227.74.45" -w nfs-fail-nas-2.pcap Unhandled exception (group=1, 
code=6)

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
$ tshark -v
TShark 1.0.6 (SVN Rev 27387)

Copyright 1998-2009 Gerald Combs <gerald () wireshark org> and contributors.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or 
FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.14.6, with WinPcap (version unknown), with libz 1.2.3, without POSIX capabilities, with libpcre 
7.0, with SMI 0.4.8, with ADNS, with Lua 5.1, with GnuTLS 2.6.3, with Gcrypt 1.4.3, with MIT Kerberos.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.0.2 (packet.dll version 4.0.0.1040), based on 
libpcap version 0.9.5.

Built using Microsoft Visual C++ 6.0 build 8804

-rwx------+ 1 robert None 465468742 2010-03-15 10:09 
-rwx------+ tcpdump.fsn1-113.pcap
-rwx------+ 1 robert None 465464756 2010-03-15 10:11 
-rwx------+ tcpdump.fsn1-114.pcap

Robert D. Scott                 Robert () ufl edu
Senior Network Engineer         352-273-0113 Phone
CNS - Network Services          352-392-2061 CNS Phone Tree
University of Florida           352-392-9440 FAX
Florida Lambda Rail             352-294-3571 FLR NOC
Gainesville, FL  32611          321-663-0421 Cell



___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
 
mailto:wireshark-users-request () wireshark org?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
 
mailto:wireshark-users-request () wireshark org?subject=unsubscribe


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe


The information contained in this e-mail and any accompanying documents is intended for the sole use of the recipient 
to whom it is addressed, and may contain information that is privileged, confidential, and prohibited from disclosure 
under applicable law. If you are not the intended recipient, or authorized to receive this on behalf of the recipient, 
you are hereby notified that any review, use, disclosure, copying, or distribution is prohibited. If you are not the 
intended recipient(s), please contact the sender by e-mail and destroy all copies of the original message. Thank you.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe