Wireshark freezes when I hit Play Streams

asked 2018-08-01 21:33:56 +0000

I'm testing the SIP/RTP sample packet SIP_DTMF2.cap from here: https://wiki.wireshark.org/SampleCapt...

I'm running Wireshark 2.6.1-0ubuntu2~18.04.0 on Linux Mint 19. All of my packages are up to date. I've tried reinstalling Wireshark but it has the same problem.

Whenever I open an RTP capture (I've tried multiple captures) and go to Telephony > VOIP Calls > Play Streams, Wireshark freezes and the process goes to 100% on the CPU.

How can I capture data on this so I can submit a bug?

edit retag flag offensive close merge delete


This is probably where Qt interacts with audio hardware. (Obviously) make sure all packages are up to date. See if you can find other Qt based audio applications to check compatibility that way.

To get a glimps of what a process is doing attach strace to it: strace -p 'pidof wireshark'

Jaap gravatar imageJaap ( 2018-08-02 08:11:16 +0000 )edit

Audacity is a QT audio application and it works fine. Packages are all up to date.

I tried running strace against Wireshark, and when I clicked 'Play Streams' I just got this repeating:

write(28, "\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377\367\377"..., 1073742) = 1073742
write(28, "\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377\371\377"..., 1073742) = 1073742
TheOneBlackMage gravatar imageTheOneBlackMage ( 2018-08-02 15:02:46 +0000 )edit

Nope, Audacity uses WxWidgets for the UI and PortAdio audio IO library (See the build information)

As for the strace snapshot, do you have huge files being created in /tmp? Not sure what handle 28 is, but if it is a temporary audio sample file, it's probably quite large.

PS: have you tried other SIP/RTP files from the sample captures page?

Jaap gravatar imageJaap ( 2018-08-02 16:00:24 +0000 )edit

I had gone by this link regarding Audacious. I guess their wiki is incorrect.

Yes, there's a 670M file wireshark_rtp_stream.TJ2972 in /tmp.

This happens on pretty much any SIP/RTP file, including ones from a training course I'm doing. For example, the "MagicJack+ short test call" and "Asterisk_ZFONE_XLITE.pcap" have the same issue.

TheOneBlackMage gravatar imageTheOneBlackMage ( 2018-08-02 16:08:01 +0000 )edit