Wireshark · Ethereal-dev: Re: [Ethereal-dev] Ethereal 0.10.4 core dumped -> with ring buffer option

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Jun 01, 2004 at 08:38:46AM +0530, raj wrote:
> On PA 11.11,
> 
> $ tethereal -a filesize:1 -b 4 -w test.pcap
> Capturing on lan0
> 33893
> Memory fault(coredump)    //             <CTRL+C or kill the process >
> 
> On HP-UX IPF 11.23,
> 
> $ tethereal -a filesize:1  -b 4 -w test.pcap
> Capturing on lan0
> 2615
> tethereal: "test_00194_20040531102059.pcap" couldn't be closed for some
> unknown reason. // <CTRL+C or kill the process >

There was a bug wherein if an attempt to close a ring buffer capture
file failed as part of the process of switching to a new capture file,
Tethereal would attempt to close it *again* when finishing up the
capture.  If the attempt fails, the file is still "closed" to the extent
that a subsequent attempt could crash or have other problems.

I've checked in a fix.

This *still* doesn't fix the underlying problem you're seeing, which is
that the attempt to close the capture fails.  I don't know why that's
happening ("fclose()" is returning EOF but *not* setting "errno", so it
gives no indication as to why it's returning EOF).