I am trying to dissect the captured pcap header using libwireshark.so, but when i call

epan_dissect_init(&edt,true,true);
epan_dissect_run();

I see this error:

Error: Unhandled Exception (group=1, code=6)

Why?

asked 25 Jan '12, 09:14

Sanny_D's gravatar image

Sanny_D
0161820
accept rate: 42%

edited 25 Jan '12, 20:09

helloworld's gravatar image

helloworld
2.7k21740


thanks guys!

there was some problem in initializing the epan

after fixing that now its working :-)

link

answered 30 Jan '12, 09:59

Sanny_D's gravatar image

Sanny_D
0161820
accept rate: 42%

As I said earlier:

" ....you are basically on your own if you are trying to use libwireshark directly. :-)

At the very least you need to be quite comfortable using a debugger to trace through the code to see why you are getting the error."

In this case, something caused an Exception (trap) and there was no code to 'handle' the exception.

I would use a debugger to step through the code following the call to epan_dissect_run() to see where the exception occurs.

You probably don't need to worry too much how exceptions work; You just need to find the place in the code which caused the exception.

link

answered 25 Jan '12, 11:48

Bill%20Meier's gravatar image

Bill Meier ♦♦
2.6k1745
accept rate: 15%

It means a dissector failed to allocate memory (see code 6's definition below)...

The exception group value is always 1, and the exception codes are defined here (based on epan/exceptions.h):

Code Description
1 BoundsError


Index is out of range.

An attempt was made to read past the end of a buffer.
This generally means that the capture was done with a "slice"
length or "snapshot" length less than the maximum packet size,
and a link-layer packet was cut short by that, so not all of the
data in the link-layer packet was available.

2 ReportedBoundsError


Index is beyond reported length (not cap_len).

An attempt was made to read past the logical end of a buffer. This
differs from a BoundsError in that the parent protocol established a
limit past which this dissector should not process in the buffer and that
limit was exceeded.
This generally means that the packet is invalid, i.e. whatever
code constructed the packet and put it on the wire didn't put enough
data into it. It is therefore currently reported as a "Malformed
packet".

However, it also happens in some cases where the packet was fragmented
and the fragments weren't reassembled. We need to add another length
field to a tvbuff, so that "length of the packet from the link layer"
and "length of the packet were it fully reassembled" are different,
and going past the first of those without going past the second would
throw a different exception, which would be reported as an "Unreassembled
packet" rather than a "Malformed packet".

3 TypeError


During display-filter parsing

4 DissectorError


A bug was detected in a dissector.

DO NOT throw this with THROW(); that means that no details about
the dissector error will be reported. (Instead, the message will
blame you for not providing details.)

Instead, use the DISSECTOR_ASSERT(), etc. macros in epan/proto.h.

5 ScsiBoundsError


Index is out of range.

An attempt was made to read past the end of a buffer.

This error is specific to SCSI data transfers where for some CDBs
it is normal that the data PDU might be short.
I.e. ReportLuns initially called with allocation_length=8, just enough
to get the "size" of lun list back after which the initiator will
reissue the command with an allocation_length that is big enough.

6 OutOfMemoryError


Running out of memory.

A dissector tried to allocate memory but that failed.

link

answered 25 Jan '12, 19:59

helloworld's gravatar image

helloworld
2.7k21740
accept rate: 27%

Thanks ppl!

i tried to fix it.. but all in vain.. what exactly is the problem? is it related to the OS i am using or the amount of virtual memory i have?

how to get rid of this error.. any help :-/

thanks|

(26 Jan '12, 10:30) Sanny_D

Go with Bill's suggestion, and step through your code with a debugger.

(26 Jan '12, 18:29) helloworld
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×114
×6

Asked: 25 Jan '12, 09:14

Seen: 1,646 times

Last updated: 30 Jan '12, 09:59

powered by OSQA