Wireshark · Ethereal-dev: Re: [Ethereal-dev] problems with tethereal...

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Thu, Mar 08, 2001 at 10:56:47AM -0600, Neulinger, Nathan R. wrote:
> I just happened to notice this when I tried to go use tethereal or
> tethereal_static. Neither of them work for me. They say "Capturing on eth0"
> and then don't display anything else.
> 
> ethereal and ethereal_static are working just fine. This is on redhat-6.2,
> latest cvs of ethereal, kernel 2.2.19pre11. 
> 
> Running under gdb seems to be sitting in pcap_read forever.
> 
> Anyone else seen this?

It worked fine for me on Debian 2.2, latest CVS of Ethereal, kernel
2.2.17, libpcap from the tcpdump.org CVS (plus a fix I was testing to
get it to, when doing a live capture, align the link-layer payload on a
4-byte boundary, but that shouldn't make a difference).  Kernel
configured with packet socket *and* socket filter support.

I'd suggest running it under "strace" to see what it's doing *inside*
"pcap_read()" when it's stalling; you may end up having to get the source
to the version of libpcap you're using (which may be the Kuznetzified
version that comes with RH 6.2, rather than a standard LBL or tcpdump.or
gone), and debug it.