Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message

From: Brian Oleksa <oleksab@xxxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 23 Mar 2010 23:47:19 -0400
Bill

I usually use the GDB debugger under Linux. Unfortunately my Linux box is being used to run another application right now so I cannot use it. This is why I was asking you about how you used editcap to debug as I am looking for another way to debug this problem (for now anyway). Tomorrow.. I will use the debugger.

Thanks,
Brian


Bill Meier wrote:
Brian Oleksa wrote:
Bill

Ok...so I found out that it crashes on frame 17641.

It only took a couple of minuets to find it. But now what do I do with this info..??


The idea is that it's sometimes easier a to debug a wireshark/tshark crash when you have a file with a single frame which causes the crash.

You can't really escape using a debugger (altho you can try putting print statements in strategic places in your dissector instead).

If you're not familiar with using the Microsoft Visual Studio (VC9) debugger, in the long run it's worth investing the time to learn how.

See http://wiki.wireshark.org/Development/Tips


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe