Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

illegal hardware instruction when read pcap #395

Open
wangduanduan opened this issue Mar 29, 2022 · 4 comments
Open

illegal hardware instruction when read pcap #395

wangduanduan opened this issue Mar 29, 2022 · 4 comments
Assignees
Labels

Comments

@wangduanduan
Copy link

system info: macOs 12.2

sngrep - 1.4.10
Copyright (C) 2013-2018 Irontec S.L.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ivan Alonso [aka Kaian]

when read pcap file

sngrep -I 1.pcap

and get error, sngrep crashed

[1]    6353 illegal hardware instruction  sngrep -I 1.pcap
@wangduanduan wangduanduan changed the title [1] 6353 illegal hardware instruction sngrep -I 1.pcap illegal hardware instruction when read pcap Mar 29, 2022
@Kaian
Copy link
Member

Kaian commented Mar 29, 2022

Hi @wangduanduan

Can you provide a pcap that causes the crash? It helps a lot.

Thanks!

@Kaian Kaian self-assigned this Mar 29, 2022
@Kaian Kaian added the crash label Mar 29, 2022
@wangduanduan
Copy link
Author

the 1.pcap file maybe has some problems, when read some others pcap, sngrep work correctly.

but wireshark can read the 1.pcap correctly, after see all packets in wireshark, i find all udp packet duplicate, include sip and rtp.

1.pcap.zip @Kaian

@Kaian
Copy link
Member

Kaian commented Apr 6, 2022

Hi,

Thanks for the test file.

I have tested this in some GNU/Linux enviroments without crash, so it looks related to macOS only.

Sadly I have no Mac available, so I cann't debug this properly.

Can this problem be reproduced with previous sngrep versions?

Thanks for the info

@ChanoAndersen
Copy link

I experience the exact same thing. But only with the version installed using Homebrew. If I compile it from source, I have no problems, until homebrew decides to update one of the libraries, after which I just need to recompile.

So it seems something in the buildprocess used by Homebrew is affecting the ability to load pcap files. Also in my case I've not had a single pcap file I can open using the affected version, it starts up, starts reading the file, and at some point doing the read, crashes with the above error.

Unfortunately I don't have pcaps to share, as they are all from production systems.

The problem has been present for at least a couple of years, and still is in the latest version (1.8.2) from homebrew.

I'm not entirely sure, but I think I've seen it on both Intel and M1 macs, but as I'm mainly on Intel, I might remember it wrong.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

3 participants