Ethereal-dev: Re: [Ethereal-dev] ethereal segfaults (0.10.3) when arp spoofing

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 13 Apr 2004 10:59:05 -0700
On Tue, Apr 13, 2004 at 01:37:31AM -0500, netmask wrote:
> I'm not sure if its related to the arp spoofing or not. I don't really see
> what the difference would be as far as Ethereal is concerned. I've never had
> this version crash or cause any issues when I'm not arp spoofing. Hopefully
> i've included enough information to do some research on it:

It looks similar to another bug that was also reported recently - and
the cause of both of those bugs appears to be the same (a variable was
initialized only for SIP-over-UDP-port-5060 and
SIP-with-media-type-of-message/sip, but used for SIP-over-TCP and for
SIP over *other* TCP, UDP, and SCTP ports.  The other bug involved
SIP-over-TCP, and yours appears to involve SIP-over-some-other-UDP-port
(or perhaps the heuristic dissectors were tried *before* the explicit
port numbers were tried).

That bug is fixed in the current CVS version.  It has nothing directly
to do with ARP spoofing; either that's a coincidence or, without the ARP
spoofing, the SIP traffic in question isn't seen by your machine.