Link-type not retrieved for rpcap interfaces configured with authentication

This issue was migrated from bug 11366 in our old bug tracker.

Original bug information:

Reporter: Dinesh Babu Sadu
Status: RESOLVED FIXED
Product: Wireshark
Component: Capture file support (libwiretap)
OS: Windows 7
Platform: x86
Version: 1.12.6

Attachments:

: UN-KNOWN Link type for the password rpcapd

Dinesh Babu Sadu said:

Build Information: Version 1.12.6 (v1.12.6-0-gee1fce6f from master-1.12)

Copyright 1998-2015 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.2, without Python, with GnuTLS 3.2.15, with Gcrypt 1.6.2, without Kerberos, with GeoIP, with PortAudio V19-devel (built Jun 17 2015), with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, without WinPcap, GnuTLS 3.2.15, Gcrypt 1.6.2, without AirPcap. Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz, with 8066MB of physical memory.

Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

Hi

RPCAPD Version: winpcap 4.1.3 Source Code (http://www.winpcap.org/install/bin/WpcapSrc_4_1_3.zip)
Wireshark Version: 1.12.6 ,Windows 7 64 Bit

I am unable to use capture filter in remote capture (Linux Interfaces on Windows)for analysis on "tcp" packets following on my RHEL6. where as the same  i am able to do in Wireshark 1.6.1.

Same i tried running "rpcapd" with NULL authentication it works fine and link-type were shown as "Ethernet" in wireshark 1.12.6
Error happens when i run "rpcapd" with password authentication.

Since i can't keep it open. So, i am running "rpcapd" with password authentication.

Thank you

Regards
Dinesh Sadu

added libwiretap oswindows version1.12 labels

Dinesh Babu Sadu said:

Created attachment 13739 UN-KNOWN Link type for the password rpcapd

Alexis La Goutte said:

*** Bug #11365 (closed) has been marked as a duplicate of this bug. ***

Dinesh Babu Sadu said:

in Wireshark-1.6.1 "Link Layer Header" is "disable". So that i can use filter-string(capture-filter) to analyze specific protocols. But where as now i can't.

Dinesh Babu Sadu said:

(In reply to Alexis La Goutte from comment #2)  
> *** Bug 11365 has been marked as a duplicate of this bug. ***  

Hi

Please find the below links for the questions asked in wireshark forum .
- https://ask.wireshark.org/questions/43716/capture-options-filter-string-error-for-unknown-link-type
- https://ask.wireshark.org/questions/43496/remote-capture-to-get-interface-list-of-linux-env-to-windows

Gerrit Code Review said:

Change 9690 had a related patch set uploaded by Pascal Quantin: Fix retrieval of data link type supported by remote interfaces with authentication

https://code.wireshark.org/review/9690

Gerrit Code Review said:

Change 9715 had a related patch set uploaded by Pascal Quantin: Fix retrieval of data link type supported by remote interfaces with authentication

https://code.wireshark.org/review/9715

Gerrit Code Review said:

Change 9690 merged by Anders Broman: Fix retrieval of data link type supported by remote interfaces with authentication

https://code.wireshark.org/review/9690

Gerrit Code Review said:

Change 9715 merged by Pascal Quantin: Fix retrieval of data link type supported by remote interfaces with authentication

https://code.wireshark.org/review/9715

Dinesh Babu Sadu said:

I would like to know when will this fix be available as part of stable release.

Pascal Quantin said:

It will be part of Wireshark 1.12.7 when released. In the meantime, I thought we had some pre releases of Wireshark 1.12.7 available in the buildbot but I cannot find any. So you could use a Wireshark 1.99.8 development build in the meantime (available on the Wireshark web site).

closed

mentioned in issue #11365 (closed)