This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

“undefined symbol ssl_print_data” when starting Wireshark

0

I just finished building wireshark from the source with a pluggable dissector by following these steps. When I start wireshark from the command line I get the following message.

"Couldn't load module /usr/local/lib/wireshark/plugins/1.11.3/PluggableDissectorSourceFilename.so: /usr/local/lib/wireshark/plugins/1.11.3/PluggableDissectorSourceFilename.so: undefined symbol: ssl_print_data"

ssl_print-data is a function that is called several times in the pluggable dissector source code PlugableDissector.c. It is defined in this header file which I copied it and included it to my wireshark folder without any changes.

This error message does not prevent wireshark from running. A quiet similar question has been asked previously but I didn't get how they resolved it. Any suggestions or hints for the possible cause/s for this problem and/or solution/s to get rid off this message?

Update: I still have the same error even with 1.10.8 version. When I removed the sentences that use the ssl_print_data function from my dissector source code, Wireshark loaded without that error message.However, this is defiantly not a solution that I will go with because I do need to use that specific function. Any suggestions?

Thank you!

asked 16 Jun '14, 11:15

flora's gravatar image

flora
156313338
accept rate: 100%

edited 25 Jun '14, 19:55


2 Answers:

0

To limit the filling of the namespace with all kinds of function names, most of which are never linked against, only function names which carry a specific prefix get published as external interface for the module. When you want to make use of a function that does not have this prefix you should add it, then the build system will handle the actual publication. The prefix in question is WS_DLL_PUBLIC, so you should add that to the function in packet-ssl-utils.h. Note that this does not make your plugin compatible with released versions of Wireshark, since these do not carry the prefix for this function. Also the 1.11 series (or any odd numbered minor version number) signifies an unmaintained development snapshot, see Release Numbers. We are about to release 1.12, the new maintained branch. You might want to work off of that.

answered 16 Jun '14, 14:14

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks for your answer. I did add WS_DLL_PUBLIC to the function as following: WS_DLL_PUBLIC void ssl_print_data(const gchar name, const guchar data, size_t len);

and then make -C plugins, Wireshark I still get the same message!

Note: the function in the header file has already extern keywords, so it should be accessible from any other source file so why do I need to include WS_DLL_PUBLIC ?

(16 Jun '14, 15:31) flora

You will have to remake the library exporting the function that is now marked as WS_DLL_PUBLIC as well as your plugin.

(19 Jun '14, 10:56) grahamb ♦

May you explain in more details how can I remark the WS_DLL_PUBLIC and the plugin?

I'm still having the same issue even after I reinstalled Wireshark 1.10.8

(25 Jun '14, 16:37) flora

The library that now export the function your plugin requires will have to be rebuilt (libwireshark.so??) and that library used in your installation along with your plugin. Reinstalling Wireshark 1.10.8 will simply reuse the original library that doesn't export the function.

(26 Jun '14, 03:12) grahamb ♦

I added the prefix as suggested and rebuild it and it works just fine now. Thank you all for your help and explanations.

(28 Jun '14, 11:43) flora

0

Please refer to this topic, I'm not sure but maybe it could help.

answered 19 Jun '14, 03:16

hoangsonk49's gravatar image

hoangsonk49
81282933
accept rate: 28%

I don't think the undefined wireshark function has to do with what is in here. In deed, I've already updated to the new APIs. Thank you for your suggestion anyway :)

(25 Jun '14, 19:44) flora