Wireshark-dev: Re: [Wireshark-dev] Tshark ver 0.99.6 crashed whole system 4th time while using
From: Guy Harris <[email protected]>
Date: Wed, 11 Jun 2008 10:31:30 -0700
Moheed Moheed Ahmad wrote:

My system mets serious crashes while running tshark using display filters and goes to *KGDB.*
Then there's probably a bug either in the kernel or in some kernel 
loadable module.  I'd suggest reporting this to MontaVista.
It's possible, but *EXTREMELY* unlikely, that TShark is doing something 
as root that can cause a crash that it couldn't do if not running as 
root.  It's *FAR* more likely that the crash is just due to a bug in 
some kernel-mode code.
 a) I was running tshark (version 0.99.6) as a root
If you run TShark 1.0, it doesn't run as root - instead, it runs dumpcap 
to do the capturing, and, while dumpcap does have to *start* running as 
root on Linux (and should be set-UID to root on Linux), it runs as root 
as little as possible.  Try installing 1.0 and *not* running as root; if 
you still have crashes, report them to MontaVista.