Hi, Is there a good writeup on how to troubleshoot Wireshark crashes, preferably covering all major operating systems? I have Wireshark running NOT capturing live traffic but analyzing a pcap file (less than 1MB). It was doing fine for a while. Then it crashed. I have a suspicion that it may be caused by an error in the Lua dissector I wrote, but I have no idea what's the error. I didn't start from a console, so no info there. I did get the crash report, but it makes no sense to me, as seen below. My questions: what evidences can we get after a crash, and how to make sense of them, without having 10 years of experience in this field? partial crash report:
asked 09 Apr ‘14, 16:37 YXI edited 09 Apr ‘14, 17:09 Hadriel |
2 Answers:
I suppose I should actually try to answer the question being asked. :) I don't know if there's a good write-up on troubleshooting wireshark crashes in particular, but I'll try to give the 30-second simplifies overview. Ultimately though, this requires some basic understanding of programming, and the C language in particular, because you'd have to look into the source code itself. Basically what I do is start with the exception type and crash dump stack trace (or sometimes called a backtrace). This is the exception type:
That tells you a SIGTRAP was issued, either on purpose or due to an exception. In this case it's not that helpful, because you could guess that from the stack trace... but sometimes it is useful, for divide by zero, memory errors, etc. This is the stack trace:
What a stack trace tells you is the last set of functions, in reverse order, that were called and are in the call stack. I.e., it stopped in Those are literally the function names from within the source code - if the program was compiled with full debug symbols, you'd even see source code filenames and such. The hex numbers to the left of the function names are the program counter addresses, which won't be helpful. The names on the left tell you which program/library it's executing for that function. " So using the stack trace you gave, I can tell the crash happens during the internal registering of Lua fields. Because I know that's what Technically the "crash" occurs in With full debug symbols it's a lot easier to figure out exactly where it happened, because you'd get the source code line numbers too. But ultimately it's not really telling you why it crashed, in the sense of what was the root cause - it's more telling you how it crashed. My guess is it's actually " The fact that it crashes is really a C-code programming error, not a Lua one - the Wireshark Lua API C-code tries to prevent actual crashes for bad Lua scripts, by doing verification checking before calling the rest of the C-code. So it's probably some incorrect Lua answered 09 Apr '14, 18:50 Hadriel showing 5 of 9 show 4 more comments |
Generally you're not expected to debug a crash yourself - I mean it's great if you can, but I don't think it's a big deal if you don't. Just submit a new bug in bugs.wireshark.org, with the info you provided above. Usually it helps to have the capture file that caused the crash, but in this case it's not a capture file - it's something wrong happening inside Wireshark during startup, when it's trying to internally register the It may well be something incorrect in your Lua script, but it still shouldn't crash. It should just generate an error and continue; preferably it should fail while loading your Lua script, before even trying to register the field(s) internally. So to help debug this you need to attach the Lua script itself to the bug ticket - or some minimal version of the script with just enough to cause the crash. Like even just the portion of the script that creates answered 09 Apr '14, 17:24 Hadriel |
Thanks. That is a very helpful crash course (no pun intended) with an example.
Your mentioning of my build being old alerted me to check the build info in the crash report. Then I realized that this is not the crash report for what happened yesterday. However, when I went to ~/Library/Logs/DiagnosticReport yesterday, there was only one crash report, the one I uploaded. It was from last week! Why there was no crash reports for the crashes happened yesterday? Could they be found somewhere else on my Mac?
You also mentioned that "if the program was compiled with full debug symbols" ... I thought the Wireshark binaries we download are already compiled with debugging turned on. That's not the case in the nightly builds? What do we have to do to have the full debug symbols?
Thanks.
You asked:
They might be in
/Library/Logs/DiagonosticReports
(note the lack of a~
tilde), but they really should be where you said. You can also view them in the Console app instead of in a terminal - i.e., Applications->Utilities->Console.You have to compile it yourself. I get full debug symbols with the one I compile locally.
Most programs aren't released with full debug symbols, because it increases the size of the program quite a bit. (and commercial products don't do it so they don't reveal internal stuff)
BTW, please submit this as a bug - Wireshark really isn't supposed to crash even with a wrong Lua script.
You don't need to include your whole script - just the portion that creates the
ProtoField
s, i.e. the part that does this type of thing:To compile it with full debug symbols, do you simply change the Makefile? I see in the Makefile there are two flag sets: CFLAG = -g ... CFLAG_FOR_BUILD = ... So do I just add "-g" to CFLAG_FOR_BUILD?
I'm not going to submit a bug now as I don't have a relevant crash report. The crash report I have is from last week (couldn't find another one even following your new advice) and I have since changed my ProtoFields quite a bit. I will submit a bug report if Wireshark crashes again after the rebuild with debug symbols and also with Wireshark launched through gdb. That way you guys will have some stuff to work with. It will probably be done in the Linux system. If it crashes in Linux, it should also do it in Mac and Windows, right (assuming they all come from exactly the same version of source code)?
You asked:
No you shouldn't have to. The Makefile is auto-generated by the
configure
script, so as long as you didautogen.sh
followed byconfigure
, then just doingmake
after that should work.Not necessarily, no. It might not even crash consistently every time in Mac... for example if a Lua object being garbage collected is causing the issue, then it's a roll of the dice. (though I don't think that's the case here)
Just read the official INSTALL instructions came in the source tarball and there was no mention of running autogen.sh before running ./configure.
So is the act of running autogen.sh before configure that ensures the debug symbols will be added for the compile?
I don't know which exact script is necessary to eventually get the Makefiles to generate full debug symbols.
autogen.sh
runslibtool
,automake
, andautoconf
, which are GNU tools for figuring out platform-specific stuff and generating the appropriate inputs to the rest of themake
process (and thus eventually the Makefiles generated byconfigure
).If I recall right, just running
configure
might be ok because I seem to recall it will actually runautogen.sh
itself if it doesn't find the right info already. Personally I always runautogen.sh
myself instead of just onlyconfigure
, because I'm used to doing it.:)
Yeah, I think autogen.sh is probably not needed. I just scanned through configure script and seems to have autoconf and automake stuff in there already.
FYI: The default
CFLAGS
from a./configure
include-g -O2
(debug symbols plus optimization).Sometimes when debugging with gdb, it's useful to disable optimization: i.e., use
-g -O0
so that the code being debugged matches the source code.This can be done easily as follows:
Note that disabling optimization may possibly cause the code to work differently: e.g. not crash when using -O2 causes a crash.
Also: when
-O2
is used, certain additional compile time checks are performed.======
re: use of
autogen.sh
I believe that downloading and building from the Wireshark "source tarball" does not require that
./autogen.sh
be run.If the Wireshark sources are downloaded from the git repository,
./autogen.sh
will need to be run before running./configure
As noted previously, any further source changes requiring
./autogen.sh
to be rerun will be automatically handled when doing amake
.