Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Wireshark on OSX Snow Leopard

From: Michael Tüxen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>
Date: Mon, 31 Aug 2009 20:44:27 +0200
Hi Guy,

OK, what do you think about the following workaround:

Index: dumpcap.c
===================================================================
--- dumpcap.c	(revision 29584)
+++ dumpcap.c	(working copy)
@@ -250,7 +250,11 @@
 /*
* Timeout, in milliseconds, for reads from the stream of captured packets.
  */
+#if defined(__APPLE__) && defined(__LP64__)
+#define	CAP_READ_TIMEOUT	1000
+#else
 #define	CAP_READ_TIMEOUT	250
+#endif
 /*
  * Timeout, in microseconds, for threaded reads from a pipe.
  */

Best regards
Michael

PS: Wireshark compiles fine on SnowLeopard, only glib-2.20.5
    does not compile out of the box...

On Aug 31, 2009, at 7:27 PM, Guy Harris wrote:


On Aug 31, 2009, at 7:08 AM, Michael Tüxen wrote:

I agree. I'm (slowly) trying to build Wireshark (and what it
depends on) on a 64-bit SL system. Up to now I discovered a
problem with dumpcap. Guy has a work around, which is not
yet committed.

I have an idea of how to do a workaround - I haven't yet checked
whether I can test at compile time whether there will be a problem or
at run time whether there is a problem, so I don't actually have a
workaround yet.

I also filed a bug on this, because the problem affects *any* code
that uses the BIOCSRTIMEOUT or BIOCGRTIMEOUT ioctls, whether directly
or through a library such as libpcap, and sets or gets a timeout
that's not an integral number of seconds - it won't work correctly in
64-bit mode.  Hopefully a fix will get into a software update.

(It works OK in 32-bit mode, so our binary packages work;
BIOCSRTIMEOUT also happens, by luck, to behave properly with integral
timeouts on little-endian machines, which is why this wasn't
discovered as soon as somebody tried to use tcpdump.)
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe