wireshark fails to open .pcap

[moment92]

Hello!
I have a strange problem. A week ago I installed wireshark and everything worked well. Then, for some pointless reasons, I reinstalled it. After that it is not able to open .pcap files. When I try to open them, wireshark just exits. I have tried to reinstall it again, but the problem remains. It is probably some strange configuration problem in my system.
What should I do to fix the problem?

[msalerno]

When I try to open them, wireshark just exits.

As in crashes? Try launching it from a terminal to see if it prints any errors. Not sure if there is a debug switch.

Does it exit on when you try to open any .pcap file? Have you tried creating a new cap and then opening that one?

[moment92]

Does it exit on when you try to open any .pcap file?

Yes, it crashes when I try to open any .pcap file. I have tried many different files. Actually I even tested the files with wireshark on Ubuntu, the files are definitely OK.

Try launching it from a terminal to see if it prints any errors.

When I open a .pcap file, it crashes and gives me:
Segmentation fault

When I try to start capturing, it also crashes and gives me:
wireshark: symbol lookup error: wireshark: undefined symbol: wtap_cleareof

[moment92]

I used gdb debugger for some additional information.

When trying to open .pcap, it gives me:

Code: Select all

Program received signal SIGSEGV, Segmentation fault.
0xb7fad2c3 in libpcap_seek_read (wth=0x8ae02a8, seek_off=40, 
    pseudo_header=0xb6249ff4, pd=0x81c1300 "", length=136057744, err=0x2a, 
    err_info=0xbfffda1c) at libpcap.c:1424
1424	libpcap.c: No such file or directory.
	in libpcap.c

When trying to start capturing, it trows:

Code: Select all

/usr/bin/wireshark: symbol lookup error: /usr/bin/wireshark: undefined symbol: wtap_cleareof

Program exited with code 0177.

[msalerno]

What's the output of "emerge -pv wireshark" ?

Try rebuilding net-libs/libpcap and wireshark? or maybe remove the pcap use flag from wireshark and then try opening a cap?

[moment92]

I have tried rebuilding wireshark and libpcap many times
Now I tried to rebuild without pcap USE flag, but the problem remains exactly the same.

emerge -pv wireshark

Code: Select all

Calculating dependencies... done!
[ebuild   R   ] net-analyzer/wireshark-1.2.10  USE="caps gtk ipv6 pcap pcre zlib -adns -ares -gcrypt -geoip -gnutls -kerberos -lua -portaudio -profile (-selinux) -smi -threads" 0 kB

[mv]

Code: Select all

Program received signal SIGSEGV, Segmentation fault.
0xb7fad2c3 in libpcap_seek_read (wth=0x8ae02a8, seek_off=40, 
    pseudo_header=0xb6249ff4, pd=0x81c1300 "", length=136057744, err=0x2a, 
    err_info=0xbfffda1c) at libpcap.c:1424
1424	libpcap.c: No such file or directory.
	in libpcap.c

I am not sure what "length" means here exactly, but it looks too large: Do you really have a 136MB file?
If not, some arguments are mangled. Maybe some library was not compiled with -D_FILE_OFFSET_BITS=64 or D_LARGEFILE_SOURCE kompiliert (or vice versa: was compiled with it but called from a program not compiled with it). Do you use amd64 or x86?

Code: Select all

/usr/bin/wireshark: symbol lookup error: /usr/bin/wireshark: undefined symbol: wtap_cleareof

This might also point to a mismatch of program and library in some CFLAGS or LDFLAGS. But you said that you recompiled libpcap and wireshark? (I suppose in this order, and with the same *FLAGS).

[moment92]

Non of my files are 136MB, they are max 10MB, smaller ones 3MB.
I have x86.

CFLAGS="-O2 -march=i686 -pipe"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"

Yes, I have recompiled wireshark and libpcap numerous times both with same flags and with different flags.

[moment92]

I installed an older wireshark release (1.0.15) and it works great. I have no idea why the new version doesn't work.