ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 12845] First start with non-empty extcap folder after inst

Date: Fri, 09 Sep 2016 07:37:47 +0000

Comment # 8 on bug 12845 from
Just a thought. If USPPcap hangs the first time, it seems that it is trying to
gather information on some socket, and therefore cannot finish the extcap
detection process properly. It never closes the socket with closesocket, but
has started to send information to Wireshark. I can imagine, that this might
cause an issue with extcap, but I have to investigate this on Windows again.
Solution here would be at first to change the utility to only send information
on the last step before exiting (at least during initial bootup and discovery). 

The reason it boots up the second time, while the first usppcap is still
running could be, that the second instance tries to do the exact same thing,
but as the first instance has still locked the socket, the second gets a
failure and does continue with its normal operations. This would indicate, that
whatever keeps USPPcap hanging is not that important from the get-go.

So, short question, if you have a hanging usbpcap and start wireshark a second
time, can you actually capture on the shown usb devices? If so, the main issue
is within USBPcap, although extcap should not hang.

Could you run Wireshark through a debugger and break when it hangs, telling us
the code-position where it is hanging? My guess would be either in
extcap-spawn.c or in extcap.c in the code for the stderr handling.


You are receiving this mail because:
  • You are watching all bug changes.