This is a static archive of our old Q&A Site. Please post any new questions and answers at

tshark hex dump


Using tshark 1.2.11 to get a hex dump of packet data gives an error:

/opt/exp/sbin/tshark -r binary_gold -x > text_gold_new ** ERROR:print.c:794:print_hex_data: assertion failed: (edt->pi.data_src) /opt/exp/sbin/tshark[5]: 2259 Abort(coredump)

Is this a known bug in 1.2.11, and is it fixed in later versions?

Here is my version info:

$ /opt/exp/sbin/tshark -v TShark 1.2.11

Copyright 1998-2010 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GLib 2.17.7, with libpcap 1.1.1, with libz 1.2.3, without POSIX capabilities, without libpcre, without SMI, without c-ares, with ADNS, without Lua, without GnuTLS, with Gcrypt 1.2.2, without Kerberos, without GeoIP.

Running on Linux, with libpcap version 1.1.1, Gcrypt 1.2.2.

Built using gcc 3.4.6.

asked 07 Jan '11, 08:09

mmcgahan's gravatar image

accept rate: 0%


Bugs should be reported on the Wireshark bugzilla site.

(07 Jan '11, 12:15) Guy Harris ♦♦