What did I do? Well, captured a packet trace of my local net - a few
hundred packets, inspected that a little, then directly started another
packet trace and started gnomeicu to see what its icq packets looked like.
Almost immediate boom.
# ethereal -v
ethereal 0.9.0, with GTK+ 1.2.8, with GLib 1.2.8, with libpcap 0.6, with
libz 1.1.3, without SNMP
#0 0x819b2fe in dfilter_foreach_interesting_field (df=0x0,
func=0x818ff60 <prime_dfilter>, user_data=0x83b5518) at dfilter.c:399
399 for (i = 0; i < df->num_interesting_fields; i++) {
(gdb) bt
#0 0x819b2fe in dfilter_foreach_interesting_field (df=0x0,
func=0x818ff60 <prime_dfilter>, user_data=0x83b5518) at dfilter.c:399
#1 0x818ff86 in epan_dissect_prime_dfilter (edt=0x83c4098, dfcode=0x0)
at epan.c:134
#2 0x815afa5 in prime_edt (data=0x83ba6e8, user_data=0x83c4098)
at colors.c:137
#3 0x4017fef0 in g_slist_foreach () from /usr/lib/libglib-1.2.so.0
#4 0x815afbe in filter_list_prime_edt (edt=0x83c4098) at colors.c:145
#5 0x814da75 in add_packet_to_packet_list (fdata=0x8472f70, cf=0x82fd020,
pseudo_header=0x8409214, buf=0x83f38e0 "\001", refilter=1) at
file.c:653
#6 0x814ddfc in read_packet (cf=0x82fd020, offset=40) at file.c:806
#7 0x814d7fa in continue_tail_cap_file (cf=0x82fd020, to_read=1,
err=0xbfffe66c) at file.c:493
#8 0x814b799 in cap_file_input_cb (data=0x82fd020, source=8,
condition=GDK_INPUT_READ) at capture.c:821
#9 0x401497c9 in gdk_io_invoke () from /usr/lib/libgdk-1.2.so.0
#10 0x4017620e in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#11 0x40177717 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#12 0x40177cdb in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#13 0x40177e59 in g_main_run () from /usr/lib/libglib-1.2.so.0
#14 0x400a5069 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#15 0x816bd6f in main (argc=0, argv=0xbffff928) at main.c:1639
#16 0x402b3577 in __libc_start_main () from /lib/libc.so.6
--
Erik I. Bolsø | email: <knan at mo.himolde.no>
The UNIX philosophy basically involves giving you enough rope to
hang yourself. And then a couple of feet more, just to be sure.
