>Hello,
>
>I got the problem that ethereal crashes while opening a file. Could somebody tell me why this
>happens. I have tried to gather as much information as possible, but I think I did not get much
>value information. In the past I usually got a back trace which help. However this time the
>ethereal behavior is different.
>
>The file is a merged file with holds data for 3600 seconds. The file size is 303135KB.
>
>Doing a back trace while opening the file as root does not give much information. The windows
>freeze (Ethereal and the window 39% of Loading: moritz.eth). The gdb program stops.
>
(...)
>
>Using the file in tethereal give the following output.
>
>tethereal -r moritz.eth -R "(gtp)" -w test.eth
>965444
>** ERROR **: file proto.c: line 2072 (alloc_field_info): assertion failed: (*length >= 0)
>aborting...
>Abgebrochen
Hi
The last error points to a field of negative length being analyzed, so it's likely to be a bug in a dissector dealing with some -possibly wrongly formatted- packet. Since this would happen when decoding a single packet -as opposing to something that happens when analyzing packet interdependencies, such as analyzing conversations- the easiest way would be to try to isolate the packet that is causing it in a smaller file and then debugging it. You can try doing it with your pre-merged files or by breaking the big one into pieces, which can be done with tcpdump according to:
http://www.ethereal.com/lists/ethereal-dev/200412/msg00306.html
The 39% in the stopped load should roughly point to the part of the file where the packet is. If you get a small file that causes the crash you can send it back.
Regards,
Francisco
