Ethereal-users: Re: [Ethereal-users] Ethereal hanging in Windows XP.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 24 Jul 2003 11:08:59 -0700
On Thu, Jul 24, 2003 at 03:39:48PM +0000, John - Great Catmando wrote:
> We have noticed a problem with Ethereal versions later than 0.9.12.  It 
> seems to hang indefinitely and send CPU utilization to 100% after stopping a 
> capture that ran longer than 30 seconds.  Name resolution is turned off so I 
> know that is not a problem.  0.9.13 and later versions exhibit this 
> behavior.  We have demonstrated this problem on multiple systems.  All 
> systems are running Windows XP SP1 that have exhibited this behavior.  Any 
> ideas as to the cause of this problem?

One possibility is a loop in a buggy dissector.

In whatever directory temporary files are put (probably c:\temp), there
will probably be one or more files with a name beginning with "ether". 
Kill off the Ethereal that's looping, and then try to read that file
with Ethereal.  If it hangs at 100% CPU, that's the problem; we'd
probably have to see that file to disagnose the problem.

Another possibility is a bug in WinPcap.  Try capturing with WinDump
rather than Ethereal and see what happens.