Will try both, but shouldn't have any impact... Did run it under strace,
just stops after the write... nothing else. Definately sucking CPU though.
Just did another check - it's not hanging in pcap_read, it's spinning around
it. I've been running with Dec 17th CVS of libpcap.
The interesting thing is - it's only a problem with tethereal... regular
ethereal works just fine.
Just found the problem - well, the cause actually. It's requiring that I
specify "-c #"... What's going on is - it's looping around pcap_read with
packet_count == 0. As soon as I specified a count, it started working.
Did I miss an update at some point, I never remember having to specify this
argument before.
-- Nathan
> -----Original Message-----
> From: David Frascone [mailto:dave@xxxxxxxxxxxx]
> Sent: Sunday, March 11, 2001 8:00 PM
> To: ethereal-dev@xxxxxxxxxxxx
> Subject: Re: [Ethereal-dev] problems with tethereal...
>
>
> Also, run it with -n. It might be hanging on DNS lookups.
>
> On Sun, Mar 11, 2001 at 05:23:46PM -0800, Guy Harris wrote:
> > On Thu, Mar 08, 2001 at 10:56:47AM -0600, Neulinger, Nathan
> R. wrote:
> > > I just happened to notice this when I tried to go use tethereal or
> > > tethereal_static. Neither of them work for me. They say
> "Capturing on eth0"
> > > and then don't display anything else.
> > >
> > > ethereal and ethereal_static are working just fine. This
> is on redhat-6.2,
> > > latest cvs of ethereal, kernel 2.2.19pre11.
> > >
> > > Running under gdb seems to be sitting in pcap_read forever.
> > >
> > > Anyone else seen this?
> >
> > It worked fine for me on Debian 2.2, latest CVS of Ethereal, kernel
> > 2.2.17, libpcap from the tcpdump.org CVS (plus a fix I was
> testing to
> > get it to, when doing a live capture, align the link-layer
> payload on a
> > 4-byte boundary, but that shouldn't make a difference). Kernel
> > configured with packet socket *and* socket filter support.
> >
> > I'd suggest running it under "strace" to see what it's
> doing *inside*
> > "pcap_read()" when it's stalling; you may end up having to
> get the source
> > to the version of libpcap you're using (which may be the
> Kuznetzified
> > version that comes with RH 6.2, rather than a standard LBL
> or tcpdump.or
> > gone), and debug it.
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>