Wireshark · Ethereal-dev: [Ethereal-dev] tcp.port == .... causes the Filtering to hang forever

[Dick Gooris <gooris@xxxxxxxxxx>]

Guy,

I think I have found an issue which may need some attention. I am
building
a protocol Sapphire (A protocol to analyze control traffic between
Signalling
gateways, and atm access concentrators) 

I start ethereal with :

	./ethereal -r debugdata

I can the see all the sapphire messages, and look quite well.
Then once it is processed, I want to get rid of overhead, so I type at
the bottom : 
tcp.port == 7777  A small window is opened, with 'Filtering', and
halfway it hangs forever.  

Of course I thought its due to the Sapphire analyzer portion, but I
placed a return
at the beginning of the sapphire function and still the problem occurs.

The next trace was generated with 'strace in front' which shows all the
library calls.
I have the feeling that read actions take place where it should not..?


./ethereal -v
ethereal 0.8.15, with GTK+ 1.2.6,
                 with libpcap 0.4,
                 with libz 1.1.3,
                 with UCD SNMP 4.1.1

Compiled under Linux (SUN Solaris gives the same kind of result)


strace ./ethereal -r debugdata

execve("./ethereal", ["./ethereal", "-r", "debugdata"], [/* 38 vars */])
= 0
brk(0)                                  = 0x824bd88
open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or
directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=S_ISGID|0400, st_size=0, ...}) = 0
                        :
                        :
  In the bottom line I enter :   tcp.port == 7777
  A small window is being opened : Filtering...
  Halfway it stops and hangs for ever, keeping calling brk, brk...
			:
			:
ioctl(3, FIONREAD, [0])                 = 0
poll(0x84097c8, 0x2, 0, 0x403402e0, 0x84097c8) = 0
gettimeofday({982309988, 907644}, NULL) = 0
write(3, ">\0\7\0x\0@\2w\0@\2\7\0@\2\0\0\0"..., 28) = 28
ioctl(3, FIONREAD, [0])                 = 0
poll(0x84097c8, 0x2, 0, 0x403402e0, 0x84097c8) = 0
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
				:
				:
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
_llseek(5, 278528, SEEK_SET)            = 0 (at 278528)
read(5, "\0\6\0*\224\0\1:\212\265\260\0\5"..., 4096) = 4096
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)     
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
gettimeofday({982309988, 933952}, NULL) = 0
write(3, "F\0\5\0x\0@\2\t\0@\2\0\0\0\0\226"..., 264) = 264
ioctl(3, FIONREAD, [0])                 = 0
gettimeofday({982309988, 934616}, NULL) = 0
ioctl(3, FIONREAD, [0])                 = 0
poll(0x836a7a8, 0x2, 0, 0x403402e0, 0x836a7a8) = 0
gettimeofday({982309988, 935029}, NULL) = 0
write(3, ">\0\7\0x\0@\2w\0@\2\7\0@\2\0\0\0"..., 28) = 28
ioctl(3, FIONREAD, [0])                 = 0
poll(0x836a7a8, 0x2, 0, 0x403402e0, 0x836a7a8) = 0
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624) 
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
_llseek(5, 282624, SEEK_SET)            = 0 (at 282624)
read(5, "\30\20\0\0303\0\0\326\267\0\tK\4"..., 4096) = 4096
brk(0x84ba000)                          = 0x84ba000
brk(0x84bd000)                          = 0x84bd000
brk(0x84c0000)                          = 0x84c0000
brk(0x84c3000)                          = 0x84c3000
brk(0x84c6000)                          = 0x84c6000
                        :
                        :
                        :
                        :
                        v    
                    brk loop


I will send the actual data (700k) to you separately to avoid email load
to dev.

Is there something I can do to get more specific info to narrow it down
?

Best regards,

	 - Dick Gooris