Ask Your Question

How to debug Wireshark crash

asked 2021-03-18 15:49:37 +0000

amit_wireshark gravatar image

Hello all,

How can I debug Wireshark (version 3.2.5) crash in WIndows 10?

  1. Would it generate a crash report if it is build with RelWithDebugInfo ?
  2. Where can I locate the crash report on Windows system? I mean does it get printed in EventViewer or some other place?
  3. Would it report the stack backtrace as a result of crash when build with RelWithDebugInfo ?

I know I have a option to submit a bug report, but I want to try it myself first.

Thanks in advance,

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

answered 2021-03-18 16:15:30 +0000

grahamb gravatar image

Unless you have modified the defaults, the crash dump will be in %LOCALAPPDATA%\CrashDumps

You can load the dump file in Visual Studio, or WinDbg. WinDbg has the !analyze command to triage the crash.

To make much sense of the crash you will need the debug symbols, these can be obtained from the download server, look for where winxx is win32 or win64 for the bitness of Wireshark you have installed. Note that due to "issues", some pdb files were not uploaded by the build process so aren't available. Unfortunately 3.2.5 was one of the affected versions. You'll need to tell the debugger where to find the symbols once you extract them from the zip.

To look any further into the crash you will also need the sources, a tarball or git checkout of the tag will be sufficient.

Finally, 3.2.x is close to end of life. If you can create the crash with the current stable version, please submit that first and it will be backported as appropriate.

edit flag offensive delete link more


Thanks for the response.

Is build with RelWithDebugInfo sufficient to get the crash dump? I don't even have the CrashDumps folder in the said location (C:\Users\<username>\AppData\Local\CrashDumps).

amit_wireshark gravatar imageamit_wireshark ( 2021-03-18 16:36:33 +0000 )edit

Any build can produce a crash dump. What the build affects is the level of optimisation in the process that may make debugging more difficult, i.e. local vars are often not available.

Check the registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps to see if a non-default DumpFolder has been set. Some types of crash, e.g. a stack overflow break things so badly that no crash dump is made. You can try running the executable under a debugger to try to catch that.

grahamb gravatar imagegrahamb ( 2021-03-18 17:16:54 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-03-18 15:49:37 +0000

Seen: 809 times

Last updated: Mar 18 '21