illegal hardware instruction when read pcap

[wangduanduan]

system info: macOs 12.2

sngrep - 1.4.10
Copyright (C) 2013-2018 Irontec S.L.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ivan Alonso [aka Kaian]

when read pcap file

sngrep -I 1.pcap

and get error, sngrep crashed

[1]    6353 illegal hardware instruction  sngrep -I 1.pcap

[Kaian]

Hi @wangduanduan

Can you provide a pcap that causes the crash? It helps a lot.

Thanks!

[wangduanduan]

the 1.pcap file maybe has some problems, when read some others pcap, sngrep work correctly.

but wireshark can read the 1.pcap correctly, after see all packets in wireshark, i find all udp packet duplicate, include sip and rtp.

1.pcap.zip @Kaian

[Kaian]

Hi,

Thanks for the test file.

I have tested this in some GNU/Linux enviroments without crash, so it looks related to macOS only.

Sadly I have no Mac available, so I cann't debug this properly.

Can this problem be reproduced with previous sngrep versions?

Thanks for the info

[ChanoAndersen]

I experience the exact same thing. But only with the version installed using Homebrew. If I compile it from source, I have no problems, until homebrew decides to update one of the libraries, after which I just need to recompile.

So it seems something in the buildprocess used by Homebrew is affecting the ability to load pcap files. Also in my case I've not had a single pcap file I can open using the affected version, it starts up, starts reading the file, and at some point doing the read, crashes with the above error.

Unfortunately I don't have pcaps to share, as they are all from production systems.

The problem has been present for at least a couple of years, and still is in the latest version (1.8.2) from homebrew.

I'm not entirely sure, but I think I've seen it on both Intel and M1 macs, but as I'm mainly on Intel, I might remember it wrong.