Ethereal-dev: Re: [ethereal-dev] Problem (feature?) after trying to stop a capture

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 15 May 2000 14:56:32 -0700 (PDT)
> I haven't seen this problem before, so...
> 
> We have found that capturing with on Win32 can cause
> Ethereal to hang, possibly indefinately. The problem 
> occurred while we were capturing traffic for a single ip 
> address. When we tried to stop the capture by clicking 
> on the stop button Ethereal seemed to hang. Only after 
> the machine we were filtering traffic for sent out a 
> packet or received a packet did Ethereal display the 
> captured data, sometimes 3 minutes later! 
> 
> After this we found out that pinging the machine also 
> solved the problem.

That sounds *extremely* suspiciously as if the timeout specified in the
"pcap_open_live()" call isn't working.

I think it may not have been implemented in the 2.01 version of WinPcap,
as I seem to remember the "Stop" button having no effect whatsoever if
no traffic was being seen.  It appears to be implemented in 2.02, as
"Stop" works on the NT partition on my machine at home, at least.

If you're using a pre-2.02 version of WinPcap, you should probably
upgrade; if you're using 2.02, there may be a bug.