

Known Bugs

On bug reporting

/!\ Please don't add new bugs here, ask the developer/user mailing lists or use our [ bugzilla] for this purpose.

For several reasons, a Wiki isn't a good way to handle bugs, e.g. how to ask questions to a new bug if no mail address was left.

New bugs added to this page will be deleted without further notice!

Not a Bug

Things our users frequently notify as bugs, but which are intended behaviour.

  1. The horizontal scrollbar in the packet list pane wasn't removed. It does automatically appear if the content doesn't fit into the window. If you widen your columns to be larger than the pane, a scrollbar will appear. You can also use View/Resize All Columns for this.
  2. Plugins are not portable between versions. Ever wondered why Wireshark keeps its plugins in a directory named after its version? That is because the plugin interface is considered an internal interface to Wireshark. Therefore it is not stable (as API and ABI) and can change with every version. So when moving from one version to the next you get a fresh install of plugins for this version. When using a 3rd party plugin, request a fresh build from the supplier.
  3. The Wireshark Windows version (as well as some other windows software) won't work well with desktop theme software, e.g. making the windows desktop look like Mac OS X. Known problems are with Alienware's Windows theme (AlienMorph(TM)?) not showing the packet list well.

  4. ICMP packets appearing when filtering for other ip based protocols. Some ICMP packets sometimes contain the packet that "caused the error" and this is going to be dissected. if you dont want to have the frames that are icmp but contain udp use "udp && ! icmp" instead of "udp" as filter.

Running Out Of Memory -> Terminate

Wireshark will terminate if it runs out of memory. There's currently no solution to this, for details and workarounds see the /OutOfMemory page.

Packet List Vertical Scrollbar

The vertical scrollbar of the packet list sometimes doesn't show up or is otherwise strange, due to a probable bug in the GTK+ toolkit. Simply resizing the Packet List (by moving the seperator bar) usually solves this problem.

Sniffer Time Stamps

Time stamps in capture files from the Windows version of Sniffer are not always interpreted correctly.

If you have a problem with time stamps in Sniffer files, try it with the latest Wireshark release. If you still have a problem with it, please add a new [ bugzilla] bug and give us a copy of a capture file with the problem, and a listing of what the time stamps on the packets should be, if possible.

Win32 only: white text color hard to read

If you use a 256 color display (e.g. for terminal services), the text color can be white on grey background which is hard to read. Workaround: Use GTK1 variant while installation.

Win32 only: Wireshark crashes at startup without any error message

This crash is due to a problem in the newly used libgcrypt in 0.99.3, a workaround is described in:

Win32 only: Saving to an already existing filename shows strange behaviour

Wireshark will ask you if you want to save to that file anyway, then asking a second time about it.

Workaround: Save to a different filename.

Capture File Rotation Error

Wireshark cannot rotate real time captures files.