I am currently running the most recent non-capture version of Ethereal (and
associated libraries) on both Windows 2000 and Windows 98 here at work and I
have found that the program crashes on a fairly routine basis when reseting
a Display Filter with the reset button. This seems to happen more often
with large capture files. Windows 2000 reports that it is debugging the
crash and writing information to a file, but I usually click cancel and just
restart Ethereal. I could try to locate the output of the debug file and
forward it on if it would be of any help.
Also, is there any way to modify the output of the "Info" column to display
the nature of the LLC connection command type (XID, RR, SABM, TEST, etc) or
is it possible to add another column to the display that would show these
commands? Currently, the only place where these commands are decoded is
deep within the LLC portion of the detailed decode.
Also, we use a packet capture program here called Win Pharoh. I there any
possibilty that Ethereal will provide the ability (it currently does not) to
open the capture files generated by this program? I could possibly provide
a sample trace file if there was any interest in adding support for this
capture file format.