This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Error: Unhandled Exception (group=1, code=6)?

0

I am trying to dissect the captured pcap header using libwireshark.so, but when i call

epan_dissect_init(&edt,true,true);
epan_dissect_run();

I see this error:

Error: Unhandled Exception (group=1, code=6)

Why?

asked 25 Jan '12, 09:14

Sanny_D's gravatar image

Sanny_D
0182021
accept rate: 50%

edited 25 Jan '12, 20:09

helloworld's gravatar image

helloworld
3.1k42041


3 Answers:

0

thanks guys!

there was some problem in initializing the epan

after fixing that now its working :-)

answered 30 Jan '12, 09:59

Sanny_D's gravatar image

Sanny_D
0182021
accept rate: 50%

2

As I said earlier:

" ....you are basically on your own if you are trying to use libwireshark directly. :-)

At the very least you need to be quite comfortable using a debugger to trace through the code to see why you are getting the error."

In this case, something caused an Exception (trap) and there was no code to 'handle' the exception.

I would use a debugger to step through the code following the call to epan_dissect_run() to see where the exception occurs.

You probably don't need to worry too much how exceptions work; You just need to find the place in the code which caused the exception.

answered 25 Jan '12, 11:48

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

2

It means a dissector failed to allocate memory (see code 6's definition below)...

The exception group value is always 1, and the exception codes are defined here (based on epan/exceptions.h):

CodeDescription
1BoundsError


Index is out of range.

An attempt was made to read past the end of a buffer.
This generally means that the capture was done with a "slice"
length or "snapshot" length less than the maximum packet size,
and a link-layer packet was cut short by that, so not all of the
data in the link-layer packet was available.

2ReportedBoundsError


Index is beyond reported length (not cap_len).

An attempt was made to read past the logical end of a buffer. This
differs from a BoundsError in that the parent protocol established a
limit past which this dissector should not process in the buffer and that
limit was exceeded.
This generally means that the packet is invalid, i.e. whatever
code constructed the packet and put it on the wire didn't put enough
data into it. It is therefore currently reported as a "Malformed
packet".

However, it also happens in some cases where the packet was fragmented
and the fragments weren't reassembled. We need to add another length
field to a tvbuff, so that "length of the packet from the link layer"
and "length of the packet were it fully reassembled" are different,
and going past the first of those without going past the second would
throw a different exception, which would be reported as an "Unreassembled
packet" rather than a "Malformed packet".

3TypeError


During display-filter parsing

4DissectorError


A bug was detected in a dissector.

DO NOT throw this with THROW(); that means that no details about
the dissector error will be reported. (Instead, the message will
blame you for not providing details.)

Instead, use the DISSECTOR_ASSERT(), etc. macros in epan/proto.h.

5ScsiBoundsError


Index is out of range.

An attempt was made to read past the end of a buffer.

This error is specific to SCSI data transfers where for some CDBs
it is normal that the data PDU might be short.
I.e. ReportLuns initially called with allocation_length=8, just enough
to get the "size" of lun list back after which the initiator will
reissue the command with an allocation_length that is big enough.

6OutOfMemoryError


Running out of memory.

A dissector tried to allocate memory but that failed.

answered 25 Jan '12, 19:59

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

Thanks ppl!

i tried to fix it.. but all in vain.. what exactly is the problem? is it related to the OS i am using or the amount of virtual memory i have?

how to get rid of this error.. any help :-/

thanks|

(26 Jan '12, 10:30) Sanny_D

Go with Bill's suggestion, and step through your code with a debugger.

(26 Jan '12, 18:29) helloworld