Tshark export to ElasticSearch (-Tek) fails with Bad json_dumper state: illegal transition
This issue was migrated from bug 15628 in our old bug tracker.
Original bug information:
Reporter: sau…@loc…
Status: RESOLVED FIXED
Product: Wireshark
Component: TShark
OS: macOS 10.14
Platform: x86-64
Version: 3.0.0
Activity
Build Information: TShark (Wireshark) 3.0.0 (v3.0.0-0-g937e33de)
Copyright 1998-2019 Gerald Combs <gerald@wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, with GLib 2.37.6, with zlib 1.2.8, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.4.17, with Gcrypt 1.7.7, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.21.0, with LZ4, with Snappy, with libxml2 2.9.9.
Running on Mac OS X 10.14.3, build 18D109 (Darwin 18.2.0), with Intel(R) Core(TM) i7-6920HQ CPU @ 2.90GHz (with SSE4.2), with 16384 MB of physical memory, with locale en_US.UTF-8/en_US.UTF-8/de_DE.UTF-8/en_US.UTF-8/de_DE.UTF-8/en_US.UTF-8, with libpcap version 1.8.1 -- Apple version 79.200.4, with GnuTLS 3.4.17, with Gcrypt 1.7.7, with zlib 1.2.11, binary plugins supported (0 loaded).
Built using clang 4.2.1 Compatible Apple LLVM 10.0.0 (clang-1000.11.45.5).
When I run tshark -Tek -r FILE I encounter errors like this: ** (process:74115): ERROR **: Bad json_dumper state: illegal transition; change=2 type=0 depth=3 prev/curr/next state=0a 00 01 It does not happen for all files, but for example, for several files in the test/captures directory of the Wireshark source code. I don't remember encountering the issue with 2.6, but have not tested the same file on both versions. In the Wireshark source directory (commit 5f4cb695984916c90649fadd550830c8dceb7fdf): the following files lead to the error $ for i in test/captures/*; do tshark -Tek -r $i > /dev/null || echo $i; done 2>/dev/null test/captures/c1222_std_example8.pcap test/captures/dhe1.pcapng.gz test/captures/dmgr.pcapng test/captures/dns-ooo.pcap test/captures/dtls12-aes128ccm8-dsb.pcapng test/captures/dtls12-aes128ccm8.pcap test/captures/http-ooo.pcap test/captures/http-ooo2.pcap test/captures/http.pcap test/captures/http2-data-reassembly.pcap test/captures/ikev1-bug-12610.pcapng.gz test/captures/ikev1-bug-12620.pcapng.gz test/captures/ikev1-certs.pcap test/captures/ikev2-decrypt-3des-sha1_160.pcap test/captures/ikev2-decrypt-aes128ccm12-2.pcap test/captures/ikev2-decrypt-aes128ccm12.pcap test/captures/ikev2-decrypt-aes192ctr.pcap test/captures/ikev2-decrypt-aes256cbc.pcapng test/captures/ikev2-decrypt-aes256ccm16.pcapng test/captures/ikev2-decrypt-aes256gcm16.pcap test/captures/ikev2-decrypt-aes256gcm8.pcap test/captures/knxip_SecureWrapper.pcap test/captures/knxip_TimerNotify.pcap test/captures/krb-816.pcap.gz test/captures/many_interfaces.pcapng.1 test/captures/many_interfaces.pcapng.2 test/captures/packet-h2-14_headers.pcapng test/captures/retrans-tls.pcap test/captures/rsa-p-lt-q.pcap test/captures/rsasnakeoil2.pcap test/captures/sample_control4_2012-03-24.pcap test/captures/segmented_fpm.pcap test/captures/sip.pcapng test/captures/sipmsg.log test/captures/smb300-aes-128-ccm.pcap.gz test/captures/smb311-aes-128-ccm.pcap.gz test/captures/snakeoil-dtls.pcap test/captures/tcp-badsegments.pcap test/captures/text2pcap_hash_eol.txt test/captures/tls-renegotiation.pcap test/captures/tls12-aes128ccm.pcap test/captures/tls12-aes256gcm.pcap test/captures/tls12-chacha20poly1305.pcap test/captures/tls12-dsb.pcapng test/captures/tls13-20-chacha20poly1305.pcap test/captures/tls13-rfc8446.pcap test/captures/udt-dtls.pcapng.gz test/captures/wireguard-ping-tcp.pcap test/captures/wireguard-psk.pcap test/captures/wpa-Induction.pcap.gz test/captures/wpa-eap-tls.pcap.gz test/captures/wpa-test-decode-mgmt.pcap.gz test/captures/wpa-test-decode-tdls.pcap.gz test/captures/wpa-test-decode.pcap.gz test/captures/wpa3-sae.pcapng.gzadded clitshark osmacos version3.0 labels
-
Change 32532 had a related patch set uploaded by Dario Lombardo: print: don't ignore FT_NONE fields in ek.
-
Change 32532 merged by Peter Wu: print: don't ignore FT_NONE fields in ek.
-
Change 32538 had a related patch set uploaded by Peter Wu: print: don't ignore FT_NONE fields in ek.
-
Change 32538 merged by Peter Wu: print: don't ignore FT_NONE fields in ek.