Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message
From: Brian Oleksa <[email protected]>
Date: Tue, 23 Mar 2010 23:47:19 -0400

I usually use the GDB debugger under Linux. Unfortunately my Linux box is being used to run another application right now so I cannot use it. This is why I was asking you about how you used editcap to debug as I am looking for another way to debug this problem (for now anyway). Tomorrow.. I will use the debugger.

Bill Meier wrote:
Brian Oleksa wrote:

Ok...so I found out that it crashes on frame 17641.

It only took a couple of minuets to find it. But now what do I do with this info..??
The idea is that it's sometimes easier a to debug a wireshark/tshark 
crash when you have a file with a single frame which causes the crash.
You can't really escape using a debugger (altho you can try putting 
print statements in strategic places in your dissector instead).
If you're not familiar with using the Microsoft Visual Studio (VC9) 
debugger, in the long run it's  worth investing the time to learn how.
See http://wiki.wireshark.org/Development/Tips

Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:[email protected]?subject=unsubscribe