Wireshark · Ethereal-dev: Re: [Ethereal-dev] CRITICAL: Ethereal 0.10.10 Locks up Windows XP Solid!

[Ulf Lamping <ulf.lamping@xxxxxx>]

Idon . wrote:

> This IS NOT a Winpcap bug.  It's an Ethereal bug, because it happens
> only when "Update list of packets in real time" is selected.  If
> "Update list of packets in real time" is not selected, capturing works
> fine.  If "Update list of packets in real time" is selected, the
> system locks up.
>
Well, just because you use a different option in Ethereal, that doesn't
mean it has to be an Ethereal bug.

Such hard crashes can only be triggered by some ring0 (kernel or driver)
code. Ethereal itself is running in ring2 (user), it cannot *directly*
trigger such a bug. It's obvious, that Ethereal finds a way to trigger
such a case *indirectly*.

Although the way the "Update list of packets in real time" option code
were recently slightly changed, IMHO this has something to do with it
(cannot see a good reason, as the things done with WinPcap there weren't
changed).

When did you changed to XP-SP2? Possible that this has something to do
with it?
Which Ethernet card/driver do you use?
Could you try a different WinPcap version (e.g. 3.0) and see if the
problems remain?

Regards, ULFL