Wireshark 4.6.0 won't launch on Windows 11

Launch

asked 2025-11-10 10:38:22 +0000

Gary007
1 ●1 ●1

updated 2025-11-10 14:52:39 +0000

Chuckc
3133 ●6 ●650 ●20

Re-installed Wireshark a number of times, would not launch. Eventually worked out it was the user settings in C:\Users\username\AppData\Roaming\Wireshark causing the problem. Rename this folder to fix. Can you ensure the installation checks for user settings problems and either fixes them or replaces this folder to prevent the same happening again.

edit retag flag offensive close merge delete

Comments

There may have been an issue with the config in the original folder.
Can you restore it then launch Wireshark from the command line to see if any errors are printed.

Chuckc ( 2025-11-10 14:53:39 +0000 )edit

C:\Program Files\Wireshark>wireshark --log-level debug

 ** (wireshark:13360) 15:50:24.759822 [Epan WARNING] C:\gitlab-builds\builds\MsQ3pox2\1\wireshark\wireshark\epan\prefs.c:4926 -- read_prefs_file(): Malformed preference at line 135 of
C:\Users\username\AppData\Roaming\Wireshark\recent_common (save preferences to remove this warning)

Does not go any further, app fails to load. Can the program be updated to either provide an on screen message asking to replace the user settings or just replace them ?

Gary007 ( 2025-11-10 15:51:41 +0000 )edit

recent_common is a ASCII file. Can you look at line 135 and share here if not sensitive data.
Can then look at the logic in prefs.c to determine issue.

Chuckc ( 2025-11-10 16:06:06 +0000 )edit

Line 135 is

.FollowStreamDialog.y: 0

This is the section
# List of custom colors selected in Qt color picker.
gui.custom_colors: 
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff",
    "ffffffff", "ffffffff"
.FollowStreamDialog.y: 0
gui.geom.FollowStreamDialog.width: 1280
gui.geom.FollowStreamDialog.height: 999
# true or false (case-insensitive).
gui.geom.FollowStreamDialog.maximized: false
# Qt Geometry State (hex byte string).
gui.geom.FollowStreamDialog.qt_geometry: 01d9d0cb0003000000000136000000000000063500000405000001360000001f000006350000040500000000000000000780000001360000001f0000063500000405

The code needs some input validation to avoid failing. I am not a programmer so cannot debug any further.

Gary007 ( 2025-11-11 09:43:43 +0000 )edit

I think the ".FollowStreamDialog.y: 0" bits are errant and should be deleted.

grahamb ( 2025-11-11 10:13:50 +0000 )edit

see more comments

answered 2025-11-11 12:35:05 +0000

Gary007
1 ●1 ●1

Maybe this entry was from a previous version. Should an upgraded version include a check for redundant config entries and remove them to prevent it crashing on launch.

edit flag offensive delete link

Comments

The first line of the file should be something like # Common recent settings file for Wireshark 4.6.0.
What version of Wireshark wrote the file?

Chuckc ( 2025-11-11 12:59:21 +0000 )edit

Can't be sure what version wrote this entry. On launch if a newer version is available it is offered and I usually install it. Previous version was 4.4.10-x64.exe.

Gary007 ( 2025-11-11 16:03:00 +0000 )edit

The corrupt line is after what should have been the last data (gui colors) written to the file.
Currently no check to see if the file close is clean.

recent.c:

    fprintf(rf, "\n# Custom colors.\n");
    fprintf(rf, "# List of custom colors selected in Qt color picker.\n");
    string_list = join_string_list(recent.custom_colors);
    fprintf(rf, RECENT_GUI_CUSTOM_COLORS ": %s\n", string_list);
    g_free(string_list);

    fclose(rf);

    /* XXX - catch I/O errors (e.g. "ran out of disk space") and return
       an error indication, or maybe write to a new recent file and
       rename that file on top of the old one only if there are not I/O
       errors. */
    return true;

Chuckc ( 2025-11-11 19:00:41 +0000 )edit

Seems like a local issue, a possible cause is some AV process blocking files. I'm not aware of this being reported much at all.

If you want too improve the handling of locally corrupted files, please raise an issue on our GitLab instance where the prevalence can be tracked, the more info you can provide would be helpful. See https://gitlab.com/wireshark/wireshar...

grahamb ( 2025-11-12 02:49:17 +0000 )edit

add a comment

Wireshark 4.6.0 won't launch on Windows 11

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Wireshark 4.6.0 won't launch on Windows 11 edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Wireshark 4.6.0 won't launch on Windows 11