This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've built Wireshark 1.12.6 from the source tarball on the download page. The only change I've made is adding a single dissector, which was working pretty solidly in the 1.10.x series. In the 1.12.6 version when I go to type an x in the display filter (such as protocol.somefield == 0x12), Wireshark immediately hangs and crashes upon typing the "x".

Thanks, Brian

asked 05 Aug '15, 07:18

brwiese's gravatar image

brwiese
26111211
accept rate: 50%

edited 05 Aug '15, 08:27

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142

is 'protocol' in 'protocol.somefield' your protocol or an already existing protocol?

(05 Aug '15, 07:26) Jaap ♦

Found the problem. My value_string variables did not have "{ 0, NULL }" as the last value. This didn't seem to be a problem in the 1.8.x and 1.10.x series, but who knows.

Thanks, Brian

permanent link

answered 06 Aug '15, 12:22

brwiese's gravatar image

brwiese
26111211
accept rate: 50%

So it was your protocol, and yes, the final {0, NULL} tuple is important, also in 1.8 and 1.10. You just got lucky, I guess.

(06 Aug '15, 22:42) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×84
×63

question asked: 05 Aug '15, 07:18

question was seen: 934 times

last updated: 06 Aug '15, 22:42

p​o​w​e​r​e​d by O​S​Q​A