Wireshark-dev: Re: [Wireshark-dev] Tshark ver 0.99.6 crashed whole system 4th time while using

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 11 Jun 2008 10:31:30 -0700
Moheed Moheed Ahmad wrote:

My system mets serious crashes while running tshark using display filters and goes to *KGDB.*

Then there's probably a bug either in the kernel or in some kernel loadable module. I'd suggest reporting this to MontaVista.

It's possible, but *EXTREMELY* unlikely, that TShark is doing something as root that can cause a crash that it couldn't do if not running as root. It's *FAR* more likely that the crash is just due to a bug in some kernel-mode code.

 a) I was running tshark (version 0.99.6) as a root

If you run TShark 1.0, it doesn't run as root - instead, it runs dumpcap to do the capturing, and, while dumpcap does have to *start* running as root on Linux (and should be set-UID to root on Linux), it runs as root as little as possible. Try installing 1.0 and *not* running as root; if you still have crashes, report them to MontaVista.