Description of problem: Started wireshark GUI as root (using sudo). Selected to capture all devices, and started to input the capture filter. Version-Release number of selected component: wireshark-gnome-1.10.10-1.fc20 Additional info: reporter: libreport-2.2.3 backtrace_rating: 4 cmdline: wireshark crash_function: gen_linktype executable: /usr/sbin/wireshark kernel: 3.16.3-200.fc20.x86_64 runlevel: N 5 type: CCpp uid: 0 Truncated backtrace: Thread no. 1 (8 frames) #2 gen_linktype at ./gencode.c:3426 #3 gen_proto at ./gencode.c:5835 #4 gen_proto_abbrev at ./gencode.c:4780 #5 pcap_parse at grammar.y:419 #6 pcap_compile at ./gencode.c:471 #7 pcap_compile_nopcap at ./gencode.c:508 #8 check_capture_filter_syntax at capture_dlg.c:632 #9 g_thread_proxy at gthread.c:798
Created attachment 942357 [details] File: backtrace
Created attachment 942358 [details] File: cgroup
Created attachment 942359 [details] File: core_backtrace
Created attachment 942360 [details] File: dso_list
Created attachment 942361 [details] File: environ
Created attachment 942362 [details] File: limits
Created attachment 942363 [details] File: maps
Created attachment 942364 [details] File: open_fds
Created attachment 942365 [details] File: proc_pid_status
Created attachment 942366 [details] File: var_log_messages
Another user experienced a similar problem: sudo wireshark (password) dismiss the running-as-root warning window reposition main window select "Capture Options" tick "Capture on all interfaces" enter into Capture Filter box: "tcp &&" - box background goes red on 1st character - after a varying number of characters, crash. On 3 tries I've gotten as far as the second '&', and as little as "tc". Window-manager: xfce. Laptop with external screen active as well as builtin. reporter: libreport-2.2.3 backtrace_rating: 4 cmdline: wireshark crash_function: gen_linktype executable: /usr/sbin/wireshark kernel: 3.16.4-200.fc20.x86_64 package: wireshark-gnome-1.10.10-1.fc20 reason: wireshark killed by SIGABRT runlevel: N 5 type: CCpp uid: 0
Created attachment 947864 [details] Proposed fix abort() is caused by gen_linktype() in libpcap, when off_linktype == (u_int) -1. gen_linktype() lacks case jump for DLT_NFLOG. Attached patch fixes the issue.
*** Bug 1061830 has been marked as a duplicate of this bug. ***
*** Bug 1096453 has been marked as a duplicate of this bug. ***
libpcap-1.5.3-3.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/libpcap-1.5.3-3.fc20
note that while this fixes the crasher (and seems to be what upstream does too), it does not resolve the actual issue of not being able to fully use nflog interfaces with these tools :/
Sure, but this bug was about the crash. If you need some other features backported please file a new bug.
Package libpcap-1.5.3-3.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing libpcap-1.5.3-3.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-16032/libpcap-1.5.3-3.fc20 then log in and leave karma (feedback).
libpcap-1.5.3-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.