https://bugzilla.novell.com/show_bug.cgi?id=685023 https://bugzilla.novell.com/show_bug.cgi?id=685023#c0 Summary: wireshark stops capturing 'File contains a record that's not valid' Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: x86-64 OS/Version: openSUSE 11.4 Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: novell@armin-herbert.de QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.0) Gecko/20100101 Firefox/4.0 A few seconds after a live capture with wireshark has started, the capture stops and these messages are written to the terminal: 23:01:26 Warn Error "Less data was read than was expected" while reading: "/tmp/wiresharkXXXXafS6og" 23:03:42 Warn Error "File contains a record that's not valid" while reading: "/tmp/wiresharkXXXXkQtcoC" The latter message repeats every one second. Searching for this I found two other distributions having experienced the same behaviour: https://bugs.archlinux.org/task/19769 https://bugzilla.redhat.com/show_bug.cgi?id=643461 Disabling zlib at compile time worked around the bug for these. In wireshark's options, in the "Capture" section, the following options are set: Promiscuous mode, rt updates, hide dialogue. The options pcap-ng and auto scrolling are unset. Tested with different interfaces. Reading a tcpdump pcap file with wireshark is no problem. Worked in 11.3, but I don't know which version from which repo I was using then. Reproducible: Always Steps to Reproduce: 1. Become root via su -, set the DISPLAY variable and wireshark & 2. choose any interface and start the capture 3. after a few seconds, the capture stops and the warnings appear Actual Results: Captured first ~3 seconds Expected Results: Keep capturing and show output -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.