[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Apr 13, 2004 at 01:37:31AM -0500, netmask wrote:
> I'm not sure if its related to the arp spoofing or not. I don't really see
> what the difference would be as far as Ethereal is concerned. I've never had
> this version crash or cause any issues when I'm not arp spoofing. Hopefully
> i've included enough information to do some research on it:

It looks similar to another bug that was also reported recently - and
the cause of both of those bugs appears to be the same (a variable was
initialized only for SIP-over-UDP-port-5060 and
SIP-with-media-type-of-message/sip, but used for SIP-over-TCP and for
SIP over *other* TCP, UDP, and SCTP ports.  The other bug involved
SIP-over-TCP, and yours appears to involve SIP-over-some-other-UDP-port
(or perhaps the heuristic dissectors were tried *before* the explicit
port numbers were tried).

That bug is fixed in the current CVS version.  It has nothing directly
to do with ARP spoofing; either that's a coincidence or, without the ARP
spoofing, the SIP traffic in question isn't seen by your machine.