the proto,colinfo tap doesn't work if the INFO column isn't being printed.

This issue was migrated from bug 3675 in our old bug tracker.

Original bug information:

Reporter: Michael
Status: RESOLVED FIXED
Product: Wireshark
Component: TShark
OS: SuSE
Platform: x86
Version: 1.2.0

Attachments:

rdp_2_packets.trc: Testcase with 2 packets
tcp-multisegment-pdu.patch: Patch to remove row block after processing multiple PDUs in TCP Packet

Michael said:

Build Information: TShark 1.2.0

Copyright 1998-2009 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.16.3, with libpcap 0.9.8, with libz 1.2.3, without POSIX capabilities, with libpcre 7.6, without SMI, without c-ares, without ADNS, without Lua, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP.

Running on Linux 2.6.25.20-0.1-pae, with libpcap version 0.9.8.

Built using gcc 4.3.1 20080507 (prerelease) [gcc-4_3-branch revision 135036].

Hello!

We are using Tshark to extract signaling information in mobile phone networks (GTP traffic). We found that the transformation of libpcap traces into a text format with the following command:

tshark -r ./2009_07_06-10h30m00s-full-tu2-600.trc -R "((gtp.message == 0x10 or gtp.message == 0x11) and not (icmp)) and (ip.src or ip.dst or udp.srcport or udp.dstport or gtp.flags.version or gtp.message or gtp.teid or gtp.seq_number or gtp.tid or  gtp.cause or gtp.imsi or gtp.teid_cp or gtp.teid_data or gtp.apn or gtp.msisdn or gtp.mcc or gtp.mnc or gtp.ext_rat_type or gtp.ext_imeisv or gtp.user_ipv4)" -t ad -z proto,colinfo,ip,ip.src -z proto,colinfo,ip,ip.dst -z proto,colinfo,ip,udp.srcport -z proto,colinfo,ip,udp.dstport -z proto,colinfo,ip,gtp.flags.version -z proto,colinfo,ip,gtp.message -z proto,colinfo,ip,gtp.teid -z proto,colinfo,ip,gtp.seq_number -z proto,colinfo,ip,gtp.tid -z proto,colinfo,ip,gtp.cause -z proto,colinfo,ip,gtp.imsi -z proto,colinfo,ip,gtp.teid_cp -z proto,colinfo,ip,gtp.teid_data -z proto,colinfo,ip,gtp.apn -z proto,colinfo,ip,gtp.msisdn -z proto,colinfo,ip,gtp.mcc -z proto,colinfo,ip,gtp.mnc -z proto,colinfo,ip,gtp.ext_rat_type -z proto,colinfo,ip,gtp.ext_imeisv -z proto,colinfo,ip,gtp

frequently crashes with the message:

tshark: the proto,colinfo tap doesn't work if the INFO column isn't being printed.

We verified this behaviour with tshark 1.20 and 1.08. Tshark 0.99.7 works fine and does NOT crash.

I have attached a trace file to this bug report. The messages which cause tshark to crash are packet numbers: 59818,67667 and 83157

Many thanks for any assistance.

added clitshark oslinux version1.2 labels

Michael said:

Trace file:

http://www.gemik.at/tmp/2009_07_06-10h30m00s-full-tu2-600.trc

William Preston said:

Created attachment 3502 Testcase with 2 packets

This testcase shows more clearly that the problem is caused by multisegment PDUs.

William Preston said:

Created attachment 3503
Patch to remove row block after processing multiple PDUs in TCP Packet

packet-tcp marks a row as unwritable if there is more
than 1 PDU in a packet to prevent overwriting of the
protocol column.

However this breaks the proto,colinfo tap which checks
rows are writable or dies EVEN if it doesn't alter anything.

Suggested patch attached to restore the initial value
after all PDUs have been processed.

Anders Broman said:

Committed revision 29535. Scheduled for 1.2.2

closed