Re: wireshark GUI vs tshark

["Maynard, Chris" <Christopher.Maynard () GTECH COM>]

The file may not be corrupt but might contain packet(s) which are
exposing a tshark bug.  If you can post the capture file, that would
probably help.  If you don't wish to post it on the mailing list, you
can open a bug report and post it there instead, marking the file as
private if you so desire so only the core developers have access to it.

- Chris

-----Original Message-----
From: wireshark-dev-bounces () wireshark org
[mailto:wireshark-dev-bounces () wireshark org] On Behalf Of Brian Oleksa
Sent: Monday, November 23, 2009 12:59 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] wireshark GUI vs tshark

Jaap and Chris

I am running this on Win XP service pack 2.
I am using wireshark Version 1.2.4 (SVN Rev 30978).

The test.pcap file has been around for a while...so chances are it is 
not corrupt. It never crashes using the GUI...it just crashes and gives 
me that pop up when I run it with that tshark command.

This is about all the information that I can provide....unless you can 
think of something else that you need..??

Thanks,
Brian


Jaap Keuter wrote:
> Hi Brian,
>
> Thanks for including the error report. It in itself doesn't tell
anything,
> other than that a problem was detected. That's why Chris asked you
some
> more questions on the whole situation. Maybe we can help you further
when
> you look into them.
>
> Thanks,
> Jaap
>
> On Mon, 23 Nov 2009 12:02:17 -0500, Brian Oleksa
> <oleksab () darkcornersoftware com> wrote:
>   
> > Chris
> >
> > I have attached the error this time....sorry about that. :-)
> >
> > I get this error when I run with tshark using the following command:
> >
> > tshark -nr test.pcap ip.dst==x.x.x.x 
> >
> > But when I filter in the GUI ... I have no problems.
> >
> > Thanks,
> > Brian
> >
> >
> >
> >
> >
> > Maynard, Chris wrote:
> >     
> > > > Any thoughts..??
> > > >     
> > > >         
> > > My first thought was, "I guess you forgot to include the error." :)
> > >
> > > In addition to the error, you might want to include some Wireshark
> > > version information, what OS you're running on and any other
> > >       
> information
>   
> > > that you think might be relevant.
> > >
> > > By the way, I tried a similar tshark command using Wireshark 1.2.4
on
> > > Windows XP SP3 with no problems.  Maybe you are running an older
> > >       
> version
>   
> > > of Wireshark with a known bug that has been fixed, or maybe your
> > > test.pcap file is corrupt or exposes a Wireshark bug, in which case
a
> > > bug report might be in order with the attached test.pcap file
included
> > > so the core developers can analyze the error and find & fix the bug.
> > >
> > > - Chris
> > >
> > > -----Original Message-----
> > > From: wireshark-dev-bounces () wireshark org
> > > [mailto:wireshark-dev-bounces () wireshark org] On Behalf Of Brian
Oleksa
> > > Sent: Sunday, November 22, 2009 10:49 PM
> > > To: Developer support list for Wireshark
> > > Subject: [Wireshark-dev] wireshark GUI vs tshark
> > >
> > >
> > > Wiresharkers
> > >
> > > When I use my dissector with the GUI... everything works fine. The
pcap
> > >       
>
>   
> > > file that I load comes right up with NO problems. I can filter 
> > > (ip.dst==x.x.x.x) with no problems.
> > >
> > > But if I try to open that same pcap file with tshark using the
> > >       
> following
>   
> > > command:
> > >
> > > tshark -nr test.pcap ip.dst==x.x.x.x     
> > >
> > > The files appears to start loading.. then I get the following error.
> > >
> > > Any thoughts..??
> > >
> > > Thanks,
> > > Brian
> > > CONFIDENTIALITY NOTICE: The contents of this email are confidential
> > > and for the exclusive use of the intended recipient. If you receive
> > >       
> this
>   
> > > email in error, please delete it from your system immediately and 
> > > notify us either by email, telephone or fax. You should not copy,
> > > forward, or otherwise disclose the content of the email.
> > >
> > >
> > >       
________________________________________________________________________
___
>   
> > > Sent via:    Wireshark-dev mailing list
<wireshark-dev () wireshark org>
> > > Archives:    http://www.wireshark.org/lists/wireshark-dev
> > > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
> > >             
> > >       
> mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
>   
________________________________________________________________________
___
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
>   
________________________________________________________________________
___
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
 
mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
CONFIDENTIALITY NOTICE: The contents of this email are confidential
and for the exclusive use of the intended recipient. If you receive this
email in error, please delete it from your system immediately and 
notify us either by email, telephone or fax. You should not copy,
forward, or otherwise disclose the content of the email.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe