Wireshark · Ethereal-users: Re: [Ethereal-users] ethereal crashes while loadin the captured file.

["Martin Regner" <martin.regner@xxxxxxxxx>]

Ravi Mudium wrote:
>I have 90 Mb capture file. When I try to stop the capture ethereal  crashed
>while  loading the capture file.
>
>Error message it gave is 
>
>GLib-ERROR **:could not allocate 65536 bytes.


It might be some problem with MAPI and/or DCE-RPC dissectors in Ethereal 0.9.12 (and at least some earlier versions also).

Guy Harris has checked in some changes to the MAPI and DCERPC dissectors some days ago, and the fixes will
be available in the next version (if you don't have possibilities to build Ethereal yourself).

http://www.ethereal.com/lists/ethereal-users/200305/msg00072.html

http://www.ethereal.com/lists/ethereal-users/200305/msg00081.html

http://www.ethereal.com/lists/ethereal-users/200305/msg00084.html

http://www.ethereal.com/lists/ethereal-users/200305/msg00087.html

http://www.ethereal.com/lists/ethereal-users/200305/msg00102.html

http://www.ethereal.com/lists/ethereal-users/200305/msg00103.html



Try to disable MAPI protocol by using the menu item Edit/Protocols.../
Click on the "MAPI" entry in the list of protocols so that it is shown as "Disabled" and then press the Apply + OK  buttons.

This will disable MAPI protocol, but not on a permanent basis. 
You'll have to do this each time you start Ethereal.

Try to load the capture file and see if you get a crash.

If you still get a crash then you could try to disable DCE/RPC protocol also.

If that doesn't help it may be another problem.