Problem running Wireshark-1.8.10 on RHEL6

tiger762 · 08-13-2015, 02:48 PM

So I've been given this RedHat box to make into a usable platform to do network troubleshooting:

Code:

[root@ccnstorage ~]# uname -a
Linux ccnstorage 2.6.32-358.el6.x86_64 #1 SMP Fri Feb 22 00:31:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

I installed the latest wireshark and wireshark-gnome. All went well:

Code:

[root@ccnstorage ~]# rpm -qa | grep wireshark
wireshark-gnome-1.8.10-17.el6.x86_64
wireshark-1.8.10-17.el6.x86_64

After I use "ssh -X" to log in remotely with X forwarding, I run wireshark. Starts up fine. I set a reasonable capture filter. This is where it got weird. Saw an error I've never seen before: "dumpcap: symbol lookup error: dumpcap: undefined symbol: pcap_set_tstamp_precision"

So It's starting dumpcap to do the actual capture. Trying dumpcap from the command line:

Code:

[root@ccnstorage ~]# dumpcap -i lo
Capturing on lo
dumpcap: symbol lookup error: dumpcap: undefined symbol: pcap_set_tstamp_precision

Hmm, alright. Let's look at it under "strace -f dumpcap -i lo"

Code:

getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0
access("/usr/share/dracut/modules.d/01fips", F_OK) = -1 ENOENT (No such file or directory)
brk(0)                                  = 0x7f81b74ab000
brk(0x7f81b74cc000)                     = 0x7f81b74cc000
sched_getparam(20565, { 0 })            = 0
sched_getscheduler(20565)               = 0 (SCHED_OTHER)
clock_getres(CLOCK_MONOTONIC, {0, 1})   = 0
sched_get_priority_min(SCHED_OTHER)     = 0
sched_get_priority_max(SCHED_OTHER)     = 0
sched_get_priority_max(SCHED_OTHER)     = 0
open("/usr/lib64/charset.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/locale.alias", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2512, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f81b5b40000
read(3, "# Locale name alias data base.\n#"..., 4096) = 2512
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f81b5b40000, 4096)            = 0
rt_sigaction(SIGTERM, {0x7f81b5b4c4c0, [], SA_RESTORER, 0x7f81b4ba8710}, NULL, 8) = 0
rt_sigaction(SIGINT, {0x7f81b5b4c4c0, [], SA_RESTORER, 0x7f81b4ba8710}, NULL, 8) = 0
rt_sigaction(SIGPIPE, {0x7f81b5b4c4c0, [], SA_RESTORER, 0x7f81b4ba8710}, NULL, 8) = 0
rt_sigaction(SIGHUP, NULL, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGHUP, {0x7f81b5b4c4c0, [], SA_RESTORER, 0x7f81b4ba8710}, NULL, 8) = 0
getuid()                                = 0
geteuid()                               = 0
getgid()                                = 0
getegid()                               = 0
getuid()                                = 0
getgid()                                = 0
write(2, "Capturing on lo\n", 16Capturing on lo
)       = 16
writev(2, [{"dumpcap", 7}, {": ", 2}, {"symbol lookup error", 19}, {": ", 2}, {"dumpcap", 7}, {": ", 2}, {"undefined symbol: pcap_set_tstam"..., 43}, {"", 0}, {"", 0}, {"\n", 1}], 10dumpcap: symbol lookup error: dumpcap: undefined symbol: pcap_set_tstamp_precision
) = 83
exit_group(127)                         = ?

So "/usr/share/dracut/modules.d/01fips" is missing as well as "/usr/lib64/charset.alias". Nothing is jumping out at me as the obvious root cause.

Any help appreciated!

John VV · 08-15-2015, 02:11 PM

can you post some information

Code:

cat /etc/redhat-release

the kernel you are using is OLD it is fro the older 6.6
and not the CURRENT 6.7

also please post any errors and warnings from this

Code:

su -
yum update

Quote:

I installed the latest wireshark and wireshark-gnome. All went well

How ?
" wireshark-1.10.0-1.el6.rft.x86_64.rpm "
is the current in the RPMForge repo for RHEL6 ( 6.7 )

jefro · 08-15-2015, 05:25 PM

I was wondering if the 1.10 would be best too.

http://pkgs.repoforge.org/wireshark/