[Guy Harris <guy@xxxxxxxxxx>]

> Ok, but why the difference between "live update" and "not live update" ?

Perhaps because, when reading a live capture, Ethereal doesn't read the
entire capture file at once, but reads it as packets arrive?

I don't know why that would make a difference, but given that there
appears to be some bizarre I/O problem, just about *anything* could
happen.

What happens if you try building ethereal with "--disable-zlib"?  Does
that work better?  (If so, the zlib on your system might be broken in
some fashion.)