Wireshark · Ethereal-users: Re: [Ethereal-users] Partial packets dump & crash

[Bart Braem <bart.braem@xxxxxxxxx>]

On Thu, 14 Oct 2004 16:55:23 -0700, Guy Harris <gharris@xxxxxxxxx> wrote:
> Bart Braem wrote:
> > I am doing network simulation and work with dumps containing partial
> > packet dumps, in this case the ethernet header is absent I just see
> > IP. Is is possible to view these dumps in ethereal?
> 
> What program is writing the packet dumps?
> 
> If they're in libpcap format, with a link-layer type of DLT_RAW,
> Ethereal can read them.
> 
The click modular router is writing them in tcpdump format. They are
not containing any information regarding the ethernet header...

> > The crash: currently when opening such a file  and specifying another
> > decoding ethereal segfaults, is this a known error?
> 
> What do you mean by "specifying another decoding"?
> 
> This probably isn't a known bug; could you tell us exactly what steps
> caused the crash?
> 
> 

It's quite easy actually: select one packet in the time-ordered list
and select decode. In that menu change to no decoding and confirm.
Voila, crashed.

Wkr,
Bart
-- 
"May the source be with you"