I think the bug is in h323 plugin.
I tried to capture with disabled h225 decoding. It works.
Thanks.
Guy Harris wrote:
> On Tue, Jun 04, 2002 at 03:47:48PM +0400, Ruben Ghazaryan wrote:
> > I run Ethereal, capturing something and click Stop.
> > After that starts Loading process and the program crashes.
>
> There might be a bug in one of the dissectors for some protocol, causing
> Ethereal to crash when it tries to analyze one of the packets in the
> capture.
>
> There will probably be a file with a name beginning with "etherXXXX" in
> either
>
> C:\Temp
>
> or
>
> C:\Documents and Settings\{your name|\Local Settings\Temp
>
> ("{your name}" is the name you login under; it'll probably be in C:\Temp
> on NT 4.0, but it might be in the other directory on W2K).
>
> Try running Ethereal and using the "Open" item in the "File" menu to
> open that temporary file. If Ethereal crashes when you try that,
> there's probably a dissector bug of some sort.
>
> In order to solve that problem, you would either
>
> 1) have to send us the capture file, so we can try to reproduce
> the problem ourselves - note that this will be making public
> data from your network
>
> or
>
> 2) either install Visual C++ and arrange that its debugger be
> started up when Ethereal crashes, or get a stack trace by
> some other means (I don't know whether you can get a stack
> trace on Windows without the VC++ debugger) and send us the
> stack trace.
>
> > The versions of installed programs are:
> > ethereal-setup-0.9.3.exe
> > WinPcap_2_3.exe
> > ethereal-093-h323-plugin-dll-003b
>
> Well, this might be a bug fixed in Ethereal 0.9.4; unfortunately, I
> don't know whether the H.323 plugin works with 0.9.4 or not - if not,
> you'd have to wait for a new version of the plugin.
>
> In addition, note that the bug might be a bug in the plugin rather than
> in Ethereal itself.