Wireshark · Ethereal-users: Re: [Ethereal-users] ethereal 0.10.3 on Windows XP crashes on Linux Vonage VoIP packet captures

["Martin Regner" <martin.regner@xxxxxxxxx>]

Jay Libove wrote:
> A coworker and I have both noticed this:  with various versions of Linux
> performing the tcpdump, ethereal 0.10.3 will crash if it tries to open a
> packet capture of Vonage Voice over IP (UDP port 5060, 5061) traffic.
>
> I get this error from Windows XP:
>
> ethereal.exe: ethereal.exe - Application error
> The instruction as "0x0067f0db" referenced memory at "0x00000000".  The
> memory could not be "written".
>
> My guess is that the ethereal module for analyzing SIP (which is what
> Vonage uses) is crashing.
>
> Has anyone else seen it / how do I formally report it to the excellent
> folks who provide ethereal to us all?
>
> tethereal (0.10.a or 0.10.3) on the same Linux machine which tcpdump'd the
> packets out in the first place can read the file without crashing.

There is a problem with SIP-dissector in 0.10.3 that has been solved in cvs
version.
The problem doesn't occur with 0.10.2 version.
I'm not completely sure if your crash is due to that fault.

I know you can get a crash when you select a SIP packet if at least one of
the conditions below is true:
-The SIP packet is sent over TCP
-The SIP packet is not sent to/from UDP port 5060 (either source port or
destination port needs to be 5060 otherwise you may get the crash)
-The preference setting "Try heuristic dissectors first" for UDP is enabled
(Edit/Preferences/Protcols/SIP)

http://www.ethereal.com/lists/ethereal-users/200405/msg00018.html