ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] MTU bug

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 16 May 2001 13:11:56 -0700 (PDT)
> I have found a bug in Ethereal 0.8.17. It segfault when I try to sniff
> packets on an ethernet device with MTU set to 700.

That may just be due to more IP datagrams being fragmented and/or more
packets sent over TCP not fitting into one segment with the lower MTU,
and to some dissector not properly checking whether it's running past
the end of the packet.

I.e., it's probably not really an issue of a non-standard MTU (Ethereal
has no idea what the MTU is on the interface), it's probably an issue of
incomplete packets, which just happen to be more likely with a
smaller-than-normal MTU.

Could you get a stack trace from the crash, so we can figure out *which*
dissector is having the problem?

Note also that Ethereal probably left a capture file around in "/tmp" or
"/var/tmp", containing the packets it'd captured before it crashed;
it'll have a name beginning with "ether", and having a bunch of random
characters after that.

If you try to read that capture file in Ethereal, it'll probably crash
again.