On Sun, Feb 29, 2004 at 12:46:33PM +0200, Yuval Pemper wrote:
> I installed Ethereal with the Gtk 2 GUI. When I try to capture with the
> "Update list of packets in real time" option turned on, the main Ethereal
> window hangs, and the Capture window doesn't open. When I forcefully close
> the main Ethereal window, it closes, and the Capture window appears. When I
> click the stop button on the Capture window, it hangs.
Is network-layer name resolution turned on? (View -> Name Resolution ->
Enable for Network Layer, at least in recent versions of Ethereal.)
If so, that'll often cause, not "hangs" in the sense of Ethereal hanging
forever, but "hangs" in the sense of long periods of time in which
Ethereal is waiting for an address-to-name resolution to complete (on
Windows, an address-to-name resolution could take a *very* long time, if
there's no DNS or host file entry for the address, and the machine with
that address isn't up or isn't running NetBIOS name service code - most
non-Windows machines are probably *not* running that).
This happens when the capture file is read; if "Update list of packets
in real time" is turned on, the capture file is read while the capture
is going on, and...
> Everything works fine when the "Update list of packets in real time" option
> isn't turned on.
...if it's not turned on, the capture file is read when the capture is
stopped, so I suspect not everything will continue to work fine if you
stop such a capture.
*Eventually*, the name resolution in question will complete, but that
could take a significant amount of time.
The other possibility is that there's a bug in a dissector causing an
infinite loop, but, again, not using "Update list of packets in real
time" wouldn't make that problem go away, it'd just defer it to the
point at which you stop the capture.