Guy Harris wrote:
>
>Is there any message from Windows about a crash? (What version of
>Windows is this?)
>
>I have, on occasion, seen GTK+ messages printed to the terminal window
>from which I've run it on UNIX; I don't know if those are the same
>underlying problem or not.
>
>> That happened (so far) with the windows for ipv4, tcp, udp and
>> ethernet, but
>> (as far as i know) only for *unsaved* data. (that is, in the few cases
>> where
>> I saved my short capture before analyzing it didn't crash).
>
>The main difference saving the capture makes is that the capture is in
>a permanent file rather than a temporary file (which means that your
>data probably isn't lost - it's probably in C:\temp or in whatever the
>per-user temporary file directory is in W2K and later, in a file whose
>name begins with "ether" and has a bunch of letters and numbers after
>that); I'm not sure why that'd make a difference, but perhaps it does.
I have got the same problem several times on Windows 98 (4.10.1998) during the last days, but never on Windows 2000.
I have used the Conversation functionality quite much on Windows 2000 (both with Ethereal 0.9.15 and nightly-builds), but it was just some
day ago I started to used it on Windows 98 (Ethereal 0.9.15).
I get the problem both after capturing and when I have loaded captures from file. I don't get it always, but quite often when
I close the Conversation window.
There is a message about "page fault in module LIBGTK-0.DLL on address 015f:6dd12559".
Unfortunately I don't have any debugger available on the Windows 98 PC.
The bytes on CS:EIP are 5b 5e c9 c3 57 4d 5f 54 52 41 4e 53 49 45 4e 54 (part of it seems to be a string "WM_TRANSIENT").
ETHEREAL orsakade ett ogiltigt sidfel i
modul LIBGTK-0.DLL på adress 015f:6dd12559.
Registrerar:
EAX=00000002 CS=015f EIP=6dd12559 EFLGS=00010202
EBX=01078ce0 SS=0167 ESP=ffffffe8 EBP=00000000
ECX=00000000 DS=0167 ESI=01078ce0 FS=4f9f
EDX=00f3bcdc ES=0167 EDI=00f5b0a0 GS=0000
Byte på CS:EIP:
5b 5e c9 c3 57 4d 5f 54 52 41 4e 53 49 45 4e 54
Stackdump: