ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] tshark (Windows) not working

From: "Maynard, Chris" <Christopher.Maynard@xxxxxxxxx>
Date: Tue, 11 May 2010 16:10:14 -0400

I don’t know where the problem lies but I suspect something to do with dumpcap.c, especially since there seem to have been a lot of changes to it recently.  Anyway, I looked through some of the changes to that file and decided to try to roll back a little farther.  Here’s what I found:

 

Everything worked fine with r32349 (2010-03-31).  From there I performed a binary search to try to narrow it down, and in the end I found that it worked fine with r32544 (2010-04-23) but failed with r32688 (2010-05-06), so hopefully that helps narrow down the problem.

 

- Chris

http://anonsvn.wireshark.org/viewvc/trunk/dumpcap.c?r1=32544&r2=32688&diff_format=l

 

 

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Abhik Sarkar
Sent: Monday, May 10, 2010 11:47 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] tshark (Windows) not working

 

PS: Interestingly, when I open the Interface List dialog in Wireshark, it shows live values in "Packet" and "Packet/s" columns for the interface. However, when I "Start" the capture on the same interface, then it gives the error below.

On Tue, May 11, 2010 at 7:44 AM, Abhik Sarkar <sarkar.abhik@xxxxxxxxx> wrote:

It's still the same, Gerald :(

E:\wireshark-src>grep 32697 *
tshark.c: * $Id: tshark.c 32697 2010-05-06 23:51:37Z gerald $

E:\wireshark-src>dumpcap -i 6


The capture session could not be initiated ().

Please check that "\Device\NPF_{96896B6D-2F50-4415-B46F-6A59A1382DB1}" is the pr


oper interface.


Help can be found at:

       http://wiki.wireshark.org/WinPcap
       http://wiki.wireshark.org/CaptureSetup

E:\wireshark-src>

 

On Mon, May 10, 2010 at 11:17 PM, Gerald Combs <gerald@xxxxxxxxxxxxx> wrote:

Can you try r32697?


Abhik Sarkar wrote:
> I get the same error with dumpcap as well.
>
> I went back to 32687 (there seem to be some major changes to dumpcap in
> 32688) and dumpcap works, but tshark gives the original error I reported:
> E:\wireshark-src\wireshark-gtk2>dumpcap -i 2
> File: C:\DOCUME~1\sarkara\LOCALS~1\Temp\wiresharkXXXXa01288
> Packets: 31 Packets dropped: 0
>
> E:\wireshark-src\wireshark-gtk2>tshark -i 2
> Capturing on Intel(R) 82567LM Gigabit Network Connection
> **
> ERROR:column-utils.c:879:???: code should not be reached
>
> E:\wireshark-src\wireshark-gtk2>
>
> Then, I went back to 32682 (there are changes in 32683 to column-utils)
> and now it works at least.
>
> So, I am staying here for now!
>
> On Mon, May 10, 2010 at 10:02 AM, Abhik Sarkar <sarkar.abhik@xxxxxxxxx

> <mailto:sarkar.abhik@xxxxxxxxx>> wrote:
>
>     Hi Joan,
>
>     I am getting that error on both tshark and Wireshark with my build
>     (32727) on Windows (32 bit). I tried doing a distclean;
>     verify_tools; setup and build. It compiles without error, but
>     refuses to capture. Looks like I chose a bad time to code a few
>     changes ;-)
>
>     I haven't got around to investigating the issue in detail (yet)... I
>     hope someone beats me to it.
>
>     Regards,
>     Abhik

CONFIDENTIALITY NOTICE: The contents of this email are confidential
and for the exclusive use of the intended recipient. If you receive this
email in error, please delete it from your system immediately and 
notify us either by email, telephone or fax. You should not copy,
forward, or otherwise disclose the content of the email.