Wireshark-bugs: [Wireshark-bugs] [Bug 6073] New: packet parser takes too long for this trace
Date: Tue, 28 Jun 2011 21:06:35 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6073

           Summary: packet parser takes too long for this trace
           Product: Wireshark
           Version: 1.6.0
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Low
         Component: TShark
        AssignedTo: [email protected]
        ReportedBy: [email protected]


Created an attachment (id=6587)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=6587)
capture file with the problem

Build Information:
[~/wireshark-1.6.0] [email protected]>./tshark -v
TShark 1.6.0 (SVN Rev Unknown from unknown)

Copyright 1998-2011 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GLib 2.24.1, with libpcap 1.0.0, with libz 1.2.3,
without
POSIX capabilities, without libpcre, with SMI 0.4.8, without c-ares, with ADNS,
without Lua, without Python, with GnuTLS 2.8.6, with Gcrypt 1.4.5, with Heimdal
Kerberos, with GeoIP.

Running on FreeBSD 8.2-RELEASE, with libpcap version 1.0.0, with libz 1.2.3.

Built using gcc 4.2.1 20070719  [FreeBSD].

--
This happens on various platforms. I have narrowed it down to these two packets
(attached).

When running "tshark -nr a.cap", the parsing takes a good 15 minutes with
tshark running at 100% CPU. When running "tshark -Vnr a.cap", the parsing is
instant.
It also takes a long time with the wireshark GUI.

The first packet shows up immediately.
The second packet shows up fifteen minutes later.

The capture was made with tcpdump and reduced to these two packets with
editcap.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.