• ReportingBugs

Reporting Bugs

Despite our best efforts, bugs make it into Wireshark from time to time. If you find a bug, we want to know about it.

First verify that this bug is not already known and/or solved. You can see this on the KnownBugs page and in the Wireshark bug database. If the problem isn't listed here please file a bug report.

Where to Report Bugs

There one preferred way of reporting bugs: the Wireshark bug database. If that fails the wireshark-dev mailing list can act as an alternative.

What to Report

Your Platform

Wireshark runs on a multitude of operating systems, including Windows, MacOS X, Linux, *BSD, Solaris, and others. It's important to let us know what platform(s) you're having trouble with. You can get the complete version and build information using one of two methods:

• In Wireshark, select Help->About Wireshark from the main menu. You can copy the build information in the about box and paste it into your report.

• From the command line, run "tshark -v" or "wireshark -v". This will print the build information in your terminal window.

In either case the build information should look something like this:

wireshark 1.0.0

Compiled with GTK+ 2.12.8, with GLib 2.14.6, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.5,
with ADNS, with Lua 5.1, with GnuTLS 1.6.1, with Gcrypt 1.2.3, with MIT
Kerberos, with PortAudio V19-devel, without AirPcap.

Running on Windows XP Service Pack 2, build 2600, with WinPcap version 4.0.2
(packet.dll version 4.0.0.1040), based on libpcap version 0.9.5.

Built using Microsoft Visual C++ 6.0

A Capture File

Including a capture file is important for two reasons: it helps us duplicate the problem and it lets us perform regression testing so that the problem doesn't reappear.

If Wireshark crashes while you're capturing, there should be a temporary capture file left over. To find this file, select Help->About Wireshark->Folders from the main menu. There should be a folder in the list called "Temp". Inside this folder should be a file called "wiresharkXXXX..." (old name: "etherXXXX..."). This is the temporary file.

How to Duplicate the Problem

In your report you should describe the steps necessary to duplicate the problem. Also mention stuff like the kind of network you capture from or type of capture file you read in. Any specifics of the platform not covered by the metadata of the bug report is also appreciated.

Debugger Output

The backtrace output of a debugger (e.g. "bt" or "bt full" under gdb) is sometimes (but not always) helpful. If possible attach it to the bug report, pasting it in the text box makes the report bloated.

Sensitive Information

If your bug report contains sensitive information you can keep the information private:

• In Bugzilla you can mark the bug and/or attachment as "private". This makes the bug/attachment accessible to the reported and/or CC list only. Further restriction can be made that only the Wireshark core developers have access to the bug.

• Instead of sending the report to the wireshark-dev mailing list (which is a public forum) you can send it to security@wireshark.org. It will then be handled within CACE technologies.

Additional Information

Bugs filed in the bug database are monitored by the developers and solved as time permits. It may be that additional information is required to find the cause of the problem. A comment will be added to the bug report requesting that information. These comments will be send to the email address that you've provided when filing the bug report, so it is important to monitor that mailbox. Please respond to these requests to keep the investigation into the problem going, even if you can't provide the information yourself. If the requested information isn't provided within a certain amount of time the only option is to close the bug report. This window depends on the severity of the problem, as follows:

Reporting Viruses

If your AV software flags a problem with Wireshark or its installer, please send an email to the wireshark-dev list or open a bug with the following information:

• The name of the virus or trojan

• The exact product you're using, including manufacturer, product name, and version

• The virus definition version or release date you're using

AV vendors won't talk to us if we don't have this information. (Half the time they won't talk to us if we do have it.) We're received several virus reports over the years. So far they've all been FalsePositives.