Ethereal-dev: Re: [Ethereal-dev] tcp.port == .... causes the Filtering to hang forever
On Fri, Feb 16, 2001 at 11:40:23AM +0100, Dick Gooris wrote:
> Guy,
>
> I think I have found an issue which may need some attention. I am
> building
> a protocol Sapphire (A protocol to analyze control traffic between
> Signalling
> gateways, and atm access concentrators)
>
> I start ethereal with :
>
> ./ethereal -r debugdata
>
> I can the see all the sapphire messages, and look quite well.
> Then once it is processed, I want to get rid of overhead, so I type at
> the bottom :
> tcp.port == 7777 A small window is opened, with 'Filtering', and
> halfway it hangs forever.
It is likely a problem in some protocol dissector. When you
initially start ethereal w/o a display filter (./ethereal -r file),
a partial decode is done --- just enough to show the summary info
in the top portion of the Ethereal GUI.
If you enable a display filter (tcp.port == 7777), a full decode is
done on every packet. Apparently some packet you have in your
trace is triggering this bug.
> I will send the actual data (700k) to you separately to avoid email load
> to dev.
> Is there something I can do to get more specific info to narrow it down
> ?
Go ahead and send me the file, if you haven't sent it to someone
else yet.
thanks,
--gilbert
