Ethereal-users: Re: [Ethereal-users] Re: Strange behaviour ethereal 0.9.0 (self compiled)
On Wed, Feb 06, 2002 at 10:08:38AM +0100, Pierluigi Frullani wrote:
> > What does
> >
> > nm /usr/X11R6/lib/libz.a | egrep 'gzseek|gzgets'
> > print
>
> nm /usr/X11/lib/libz.a | egrep 'gzseek|gzgets'
> 0000000000000a54 T gzseek
> no gzgets.
> on the other libz in /usr/lib
>
> nm /usr/lib/libz.a | egrep 'gzseek|gzgets'
> 0000000000001464 T gzgets
> 0000000000000c88 T gzseek
OK, they added "gzseek()" in 1.0.6, so it's in the 1.0.8 that comes with
X11.
However, it was apparently broken, in 1.0.8, when reading uncompressed
files; the ChangeLog file for the current version, 1.1.3, says
Changes in 1.0.9 (17 Feb 1998)
- added gzputs and gzgets functions
- do not clear eof flag in gzseek (Mark Diekhans)
- fix gzseek for files in transparent mode (Mark Diekhans)
...
This means that Ethereal will not work correctly with zlib 1.0.8, as it
depends *very* heavily on "gzseek()" working.
One place where it depends on it working is in the code to open libpcap
files; if the file has any packets at all, it tries to read a couple of
packets, in order to figure out which of the N different versions of
libpcap file it is (there have been changes made to libpcap that changed
the file format incompatibly *without* changing the magic number or
anything else in the file header). It then seeks backward to the first
packet after doing that, so that you start reading at the first packet;
if seeks don't work, that won't work, either.
If there aren't any packets in the file, the attempt to read packets
will get an EOF, and no seek backwards will be done; a "Update list of
packets in real time" capture involves one process writing to the file
and the main process reading it, and the file starts out with no packets
before the other process has written anything to it, so you manage to
be lucky in that case.
However, another place where it depends on "gzseek()" working is in the
code that lets you select packets and see them - it does random access
to the capture file to do that. I.e., you can't just change the way the
libpcap code works and make that no longer a problem - if "gzseek()"
doesn't work in some version of zlib, Ethereal won't work when built
with support for compressed files.
I will therefore get rid of our own version of "gzgets()", and make the
configure script check whether zlib has "gzgets()", using that as a way
of detecting whether we have a version of zlib that we can use or not.
I'd suggest rebuilding XFree86 with the "the OS has zlib" flag turned
off, as per what I think I sent out in earlier mail, installing XFree86
again, getting rid of "/usr/X11/lib/libz.a" (and any "zlib.h" header
file under "/usr/X11"), doing a "make distclean" in the top-level
directory of Ethereal, doing a "configure" (don't use "--disable-zlib"),
and then remake Ethereal.
