Error loading pcap file

asked 2021-03-26 05:20:52 +0000

Beetroot gravatar image

updated 2021-03-26 05:21:56 +0000

Before the recent update i could load a pcap file of 6GB on wireshark but now after the update, the same file loads to a point it gives a message of "unspecified fatal error encountered, aborting" then wireshark shuts down. Could there be a reason?

edit retag flag offensive close merge delete

Comments

What version were you running before the update, and what version were you running after the update? (The most recent update updated both the 3.2.x and 3.4.x versions.)

Guy Harris gravatar imageGuy Harris ( 2021-03-26 08:15:25 +0000 )edit

With version 3.4.4 I consumed 11 GB RAM for a 2047 MB PCAP file. Without a file loaded it uses under 100 MB of RAM.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2021-03-26 12:40:18 +0000 )edit

There are two issues here:

  1. The fatal error, which is really weird, as that message appears to come from GLib, not from Wireshark itself, and would be reported only for certain fatal errors reported through GLib's g_log() interface in some weird circumstances, and looks really hard to produce;
  2. Large memory consumption for large files.

2 might be the cause of 1, but that's not clear.

Guy Harris gravatar imageGuy Harris ( 2021-03-26 20:18:23 +0000 )edit

In addition to the Wireshark versions before and after the update, we also need to know what version of what operating system is this on, and whether it's 32-bit or 64-bit.

Guy Harris gravatar imageGuy Harris ( 2021-03-26 20:19:15 +0000 )edit

Thank you all for the response, as for the version of Wireshark i run now it is v3.4.4 as for the previous version am not so sure and the version of Windows am running now is a 64bit OS with x64-based processor (currently)

Beetroot gravatar imageBeetroot ( 2021-03-27 03:03:43 +0000 )edit
add a comment