Wireshark · Wireshark-dev: Re: [Wireshark-dev] Tshark ver 0.99.6 crashed whole system 4th time while using display-filter optio

[Guy Harris <guy@xxxxxxxxxxxx>]

Moheed Moheed Ahmad wrote:

> My system mets serious crashes while running tshark using display 
> filters and goes to *KGDB.*

Then there's probably a bug either in the kernel or in some kernel 
loadable module.  I'd suggest reporting this to MontaVista.

It's possible, but *EXTREMELY* unlikely, that TShark is doing something 
as root that can cause a crash that it couldn't do if not running as 
root.  It's *FAR* more likely that the crash is just due to a bug in 
some kernel-mode code.

>  a) I was running tshark (version 0.99.6) as a root

If you run TShark 1.0, it doesn't run as root - instead, it runs dumpcap 
to do the capturing, and, while dumpcap does have to *start* running as 
root on Linux (and should be set-UID to root on Linux), it runs as root 
as little as possible.  Try installing 1.0 and *not* running as root; if 
you still have crashes, report them to MontaVista.