ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 9980] Capture filter "ether host ::" crash

Date: Thu, 10 Apr 2014 20:33:30 +0000

changed bug 9980

What Removed Added
Status UNCONFIRMED RESOLVED
Resolution --- NOTOURBUG

Comment # 1 on bug 9980 from
That's correct, and the parser is part of WinPcap, not part of Wireshark.

This is fixed in recent versions of libpcap.  The problem is that, unless you
have 6 octets separated by colons, the address is treated by the parser as an
IPv6 address, not a MAC address, and the BPF code generator was not explicitly
checking for an IPv6 address being used with "ether host", and was thus
treating it as a "this can't possibly happen, I'm going to crash" case; it was
fixed to report "link-layer modifier applied to ip6 host".

Unfortunately, there is not currently a version of WinPcap based on a recent
version of libpcap, so, on Windows, there's no version of WinPcap that will
report "link-layer modifier applied to ip6 host" rather than crashing.


You are receiving this mail because:
  • You are watching all bug changes.