Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] Runtime error in proto.c when filtering capture file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeroen Eeuwes <jeroeneeuwes@xxxxxxxxx>
Date: Tue, 3 May 2005 09:52:41 +0200
Hi all,

I have several capture files which I have generated using Kismet on a
Linksys WRT54G wireless access point. Since a few days I have files
that generate a runtime error.

I can read the file into Ethereal 0.10.10 without problems. When I try
to filter the packets I get an error. At that point Ethereal displays
it's working on packet 32000 (of 1000001).

The error is:

** ERROR **: file proto.c: line 1398: assertion failed: (hfinfo->type
== FT_STRING || hfinfo->type == FT_STRINGZ).

I usually first filter on "!(wlan.fc.subtype ==4 or wlan.fc.subtype ==
8)", but the same happens when I try other filtsers like "http" or
"msnms".

The same error occurs on a Debian (unstable) linux system as a Windows
XP SP2 system. It obviously is related to the capture file, since I
have other files (same size) which don't generate an error.

I've tried searching the mailing lists on the website, but this
doesn't quite work. It won't display the results (except the number
found). It doesn't matter if I try with Firefox or with IE. When I
google I've found this thread:
http://www.ethereal.com/lists/ethereal-users/200106/msg00268.html
which seems to deal with a similar problem (which according to the
follow-ups was fixed).

I've tried to narrow down on the packet which might give this problem.
I first tried creating a new file using "save as" and giving the range
of packets 32000-33000. I can filter the new file without problems. So
I created several files with larger ranges up to 20000-45000, but I
can filter the resulting files without problems.

I'm rather new to all of this, so I 'm not sure how to proceed further. 

With regards,
Jeroen