Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 5059] New: Warn Error "Less data was read than was expected"

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5059

           Summary: Warn Error "Less data was read than was expected"
           Product: Wireshark
           Version: 1.4.0
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: linas_fi@xxxxxxxxx


Build Information:
Version 1.2.9

Compiled with GTK+ 2.20.1, (64-bit) with GLib 2.24.1, with libpcap 1.1.1, with
libz 1.2.5, with POSIX capabilities (Linux), with libpcre 8.2, without SMI,
without c-ares, without ADNS, without Lua, with GnuTLS 2.8.6, with Gcrypt
1.4.5,
with Heimdal Kerberos, without GeoIP, without PortAudio, without AirPcap.

Running on Linux 2.6.34-ARCH, with libpcap version 1.1.1, GnuTLS 2.8.6, Gcrypt
1.4.5.

Built using gcc 4.5.0 20100520 (prerelease).
--
I am having a problem where Wireshark begins capturing packets, and then stops
(updating packets in real time, and data being transfered). Sometimes, but not
always, some 'Ethernet [Malformed Packet]' frames appear in the window.

The following messages appear in the console:

Warn Error "Less data was read than was expected" while reading:
"/tmp/wiresharkXXXX0e1H3j"
Warn Error "File contains a record that's not valid" while reading:
"/tmp/wiresharkXXXX0e1H3j"
(this last one repeated every second)

My guess is that due to a read of only partial data, wireshark desyncs with the
file format, 
thus all subsequent packets reads are erroneus.
In fact, doing "Reload this capture file" does load much more data.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.