Wireshark · Ethereal-users: Re: [Ethereal-users] Blue Screen after stopping capture

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Aug 29, 2002 at 04:26:10PM -0600, Robert Brown wrote:
> I have loaded ethereal on my PC and am having a problem
>  
> After capturing data and I press the stop button my computer will blue
> screen
>  
> I get the following error
>  
> ***       STOP:   0X0000000A  (0XFEED8001, 0X00000002, 0X00000000,
> 0XFEED8001)
> IRQL_NOT_LESS_OR_EQUAL

It should display more information than that - as I remember, NT blue
screens display some stack-trace information, which lists the files from
which the routines that had been called came, giving at least some clue
as to which module caused the problem.

What happens if you run WinDump with the "-c" flag, to get it to
capture, say, 5 packets?   Does the system give a blue screen when
WinDump finishes?  If so, it's probably a WinPcap problem; report it to
the WinPcap developers:

	http://winpcap.polito.it/contact.htm

(If not, it might *still* be a WinPcap problem, but it might not; in any
case, however, it's a problem with *some* piece of NT kernel-mode code.)