I think i've stumbled upon a serious bug in ethereal versions 0.7.8 and 0.7.9
(0.7.7 works perfectly all right).
Ethereal freezes when capturing packets, and I'm almost sure that it's not the
problem you described (the one that occurs under Linux when there's low LAN
traffic) - first of all, Ethereal 0.7.7 works perfect, and then our local
network is quite loaded with traffic all the time, so it shouldn't be the
problem with libpcap for Linux.
The freezing I'm talking about occurs in the following way:
1. I run Ethereal from x terminal (safer)
2. So far so good... I go to "capture" -> "start..."
3. I press "OK"
4. the "Ethereal: Capture/Playback" window appears, but apart from the title
bar (which displays the "Ethereal: Capture/Playback" string) the window is empty
(no widgets are visible, absolutely nothing).
5. Ethereal is dead. Doesn't respond to clicking any of the close window
buttons (Capture window nor Main window). No errors are displayed on the
console, and it responds properly to CTRL-C combo, exiting properly though.
When setting up capture options, I usually uncheck "Enable name resolution"
(because name resolution slowed me down in previous working versions of
Ethereal) and set capture length to something around 5000 (because my eth0's MTU
is 3924 bytes), but leaving those two intact doesn't help. Supplying a filter
expression in filter dialog doesn't change anything (well it actually outputs a
message to the terminal that says: "Kernel filter, protocol ALL, raw packet
socket", but it seems that it a normal operation message, not an error message)
and Ethereal always freezes the same way.
The given problem always occured. I tried it with different ethereal packages :
-- original ethereal-0.7.9-tar.gz that I compiled manually (though I prefer
using RPMs, I haven't got time to compile everything manually)
-- ethereal-0.7.8-1.i586.rpm package that I rebuilt from a source RPM made by
Henri Gomez <gomez@xxxxxxx>
-- ethereal-0.7.8-1.i386.rpm binary actually built by Henri Gomez
-- ethereal-0.7.9 packages from Henri Gomez, too
For now, I have to fall back to Ethereal 0.7.7. I hope this bug gets someone's
attention, because new features in Ethereal 0.7.8 and 0.7.9 seem to be great.
I'm using Mandrake Linux 6.1 (kernel 2.2.13), libpcap 0.4 (RPM package release
16 compiled from tcpdump-3.4-16 source RPM), which is the original libpcap
package included with Mandrake 6.1 distro.
Best regards,
--
Aleksander Adamowski
the_olo@xxxxxxxxxxxxx
