The Wireshark crash

This issue was migrated from bug 8896 in our old bug tracker.

Original bug information:

Reporter: eya…@‍hot…
Status: RESOLVED WORKSFORME
Product: Wireshark
Component: GTK+ UI
OS: Windows Server 2008 R2
Platform: x86-64
Version: 1.10.0

Attachments:

: Wireshark crash
wireshark_pcapng_DA898285-18D8-48F6-88E4-3917272BAC8C_20130704172319_a01796: temp captured file
SMG-CCEG-T38.pcap.zip: Wireshark crashes if filtering the file
SMG-CCEG-T38.pcap.pcapng.gz: Wireshark crashes if filtering the file - extracted from zip file

eya…@‍hot… said:

Created attachment 11146

Wireshark crash

Build Information:

Version 1.10.0 (SVN Rev 49790 from /trunk-1.10)

Built using Microsoft Visual C++ 10.0 build 40219

Hello,
After filtering the incoming packets by a specific port and running with default parameters, the Wireshark is crash after awhile.
Please advise.
Eyal

added crash oswindows uigtk version1.10 labels

Alexis La Goutte said:

Hi,

If no filtering incoming packet, there is no crash ?

Do you have try in other OS ?

Evan Huus said:

Could you be running out of memory? If not, does re-opening the capture file cause the crash?

See http://wiki.wireshark.org/ReportingBugs for instructions on how to find the Capture File.

eya…@‍hot… said:

No out of memory and No re-opening the capture file , the crash is happened while it captures the traffic.

I will send the capture file from the temp folder

(In reply to comment #2)

Could you be running out of memory? If not, does re-opening the capture file cause the crash?

See http://wiki.wireshark.org/ReportingBugs for instructions on how to find the Capture File.

eya…@‍hot… said:

Created attachment 11148 temp captured file

Hi, I've noticed that the capture file in the temp folder is still being captured while only the Wireshark GUI have crushed. I had to press the "close program" button to stop the capturing and enabling the file to be sent. Eyal

eya…@‍hot… said:

Hi,
The Wireshark is crashed even without filtering, I just tested this issue. The difference between filtered and without-filter is the time of crash since the running the application.

I also currently check with filtering on Win7 OS, I will update when I'll have answer.

Eyal

(In reply to comment #1)

Hi,

If no filtering incoming packet, there is no crash ?

Do you have try in other OS ?

Evan Huus said:

If it's not the dissection, not the filtering engine, and not a memory issue, then I'm not sure what else to try to figure out what's causing the crash.

Is there any way for you to run Wireshark in a debugger and get a stack trace when it crashes?

eya…@‍hot… said:

How to run Wireshark in debug mode and get a stack trace when it crashes??

(In reply to comment #6)

If it's not the dissection, not the filtering engine, and not a memory issue, then I'm not sure what else to try to figure out what's causing the crash.

Is there any way for you to run Wireshark in a debugger and get a stack trace when it crashes?

Alexis La Goutte said:

(In reply to comment #6)

If it's not the dissection, not the filtering engine, and not a memory issue, then I'm not sure what else to try to figure out what's causing the crash.

Is there any way for you to run Wireshark in a debugger and get a stack trace when it crashes?

May be OS specfic ? ( Windows Server 2008 R2...)

eya…@‍hot… said:

(In reply to comment #8)

(In reply to comment #6)

If it's not the dissection, not the filtering engine, and not a memory issue, then I'm not sure what else to try to figure out what's causing the crash.

Is there any way for you to run Wireshark in a debugger and get a stack trace when it crashes?

May be OS specfic ? ( Windows Server 2008 R2...)

Probably relevant OS specific Windows Server 2008 R2 64 bit

eya…@‍hot… said:

(In reply to comment #9)

(In reply to comment #8)

(In reply to comment #6)

If it's not the dissection, not the filtering engine, and not a memory issue, then I'm not sure what else to try to figure out what's causing the crash.

Is there any way for you to run Wireshark in a debugger and get a stack trace when it crashes?

May be OS specfic ? ( Windows Server 2008 R2...)

Probably relevant OS specific Windows Server 2008 R2 64 bit

Which version number is stable and good for the Windows Server 2008 R2 64 bit ?

Evan Huus said:

Normally I would recommend 1.10, but since that doesn't seem to be working for you, you can try the old-stable version (1.8.8).

http://wiresharkdownloads.riverbed.com/wireshark/win64/Wireshark-win64-1.8.8.exe

vachev said:

Created attachment 11226 Wireshark crashes if filtering the file

vachev said:

Hello,

I added a file that makes Wireshark crash on 2 different systems:

If you open the file and filter by VoIP Calls Wireshark crashes while applying the filter.

Computers:

1. PC with Windows 8 Pro 64 bits
   4GB RAM
   Intel Core i3
   Wireshark 1.8.6 (rev 48142)

2. Server Windows 2008 R2 64 bits
   32GB RAM
   Xeon E5
   Wireshark 1.10.0 (rev 49790)

Also if i apply a filter on a live capture Wireshark crashes (randomly)

This is a show stopper for me :( any idea why is wireshark crashing?

vachev said:

Hello,

I added a file that makes Wireshark crash on 2 different systems:

If you open the file and filter by VoIP Calls Wireshark crashes while applying the filter.

Computers:

1. PC with Windows 8 Pro 64 bits
   4GB RAM
   Intel Core i3
   Wireshark 1.8.6 (rev 48142)

2. Server Windows 2008 R2 64 bits
   32GB RAM
   Xeon E5
   Wireshark 1.10.0 (rev 49790)

Also if i apply a filter on a live capture Wireshark crashes (randomly)

This is a show stopper for me :( any idea why is wireshark crashing?

Christopher Maynard said:

(In reply to comment #14)

Also if i apply a filter on a live capture Wireshark crashes (randomly)

It's possible this is due to bug #6217 (closed)?

Alexis La Goutte said:

(In reply to comment #15)

(In reply to comment #14)

Also if i apply a filter on a live capture Wireshark crashes (randomly)

It's possible this is due to bug #6217 (closed)?

Or duplicate of Bug #8736 (closed) ?

Jeff Morriss said:

Created attachment 11227 Wireshark crashes if filtering the file - extracted from zip file

Extracted the capture file so it can be harvested for fuzz testing.

Jeff Morriss said:

(In reply to comment #13)

Hello,

I added a file that makes Wireshark crash on 2 different systems:

If you open the file and filter by VoIP Calls Wireshark crashes while applying the filter.

Computers:

1. PC with Windows 8 Pro 64 bits
   4GB RAM
   Intel Core i3
   Wireshark 1.8.6 (rev 48142)

2. Server Windows 2008 R2 64 bits
   32GB RAM
   Xeon E5
   Wireshark 1.10.0 (rev 49790)

This problem (attachment 11227) is, as Alexis suggested, a dup of bug #8736 (closed). It will be fixed in 1.10.1. If you need an immediate fix, please download a buildbot build:

https://www.wireshark.org/download/automated/

NOTE: it looks like this bug report is now tracking a couple different crash reports. I'd consider vachev's problem closed, leaving eyalsavion's problem.

Evan Huus said:

Eyal, are you still seeing this issue with 1.10.2? Can you provide any further information?

eya…@‍hot… said:

(In reply to comment #19)

Eyal, are you still seeing this issue with 1.10.2? Can you provide any further information?

Since weeks ago using old-stable version (1.8.8).

Thanks, Eyal

Evan Huus said:

I dislike closing the bug like this, but without some further way to reproduce the issue there isn't anything else we can do. It may be worth trying version 1.10.2 (which has many fixes from 1.10.0), but it would just be luck if the issue got fixed somewhere else.

closed