ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] too long timeout when invalid remote IP address capture options

From: Jan Barienčík <xbarienc@xxxxxxxxxx>
Date: Tue, 29 Jun 2010 23:20:17 +0200
I've been testing remote capture feature in wireshark and getting
fallowing issue. When I try to use remote interface with invalid IP
address (with ICMP Destination Host Unreachable reply) wireshark freezes
for 3 minutes approximately. This is really long timeout and application
becomes unusable.

issue can be invoked by:
- inserting invalid IP address into Remote interface dialog, for example
169.0.0.1
- re-opening capture options after capturing on IP which is invalid now,
for example after turning link down

issue is caused by socket connect timeout
strace says:

..
socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4
connect(4, {sa_family=AF_INET, sin_port=htons(2002),
sin_addr=inet_addr("162.169.0.1")}, 16) = -1 ENETUNREACH
(Network is unreachable)
close(4)
..

how to fix it without changing global values in /proc/sys/net/ipv4/?

tested on
CentOS 5.4 - wireshark 1.2.7 built from tarball
Debian GNU/Linux Testing (squeeze) - wireshark 1.3.5 built from tarball