Wireshark failure to run

swilly · 2025-05-28 14:22:05

I installed wireshark-cli by `yay` and it is installed expectedly

$ yay -Qi wireshark-cli
Name            : wireshark-cli
Version         : 4.4.6-2

But it will throw errors

$ tshark 
zsh: IOT instruction (core dumped)  tshark
$ coredumpctl debug
           PID: 25826 (tshark)
           UID: 1000 (hervey_arch)
           GID: 1006 (hervey_arch)
        Signal: 6 (ABRT)
     Timestamp: Wed 2025-05-28 22:18:01 CST (3min 15s ago)
  Command Line: tshark
    Executable: /usr/bin/tshark
 Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-org.kde.konsole-1197.scope
          Unit: user@1000.service
     User Unit: app-org.kde.konsole-1197.scope
         Slice: user-1000.slice
     Owner UID: 1000 (hervey_arch)
       Boot ID: fb23f4846bf140e7a0823fd5f0c9bceb
    Machine ID: 2c4a7b6d00d3497792ef5a6c2ccb3af5
      Hostname: CzgArch
       Storage: /var/lib/systemd/coredump/core.tshark.1000.fb23f4846bf140e7a0823fd5f0c9bceb.25826.1748441881000000.zst (present)
  Size on Disk: 11.8M
       Message: Process 25826 (tshark) of user 1000 dumped core.
                
                Stack trace of thread 25826:
                #0  0x00007f4988abd74c n/a (libc.so.6 + 0x9774c)
                #1  0x00007f4988a63dc0 raise (libc.so.6 + 0x3ddc0)
                #2  0x00007f4988a4b57a abort (libc.so.6 + 0x2557a)
                #3  0x00007f498e3fd03a n/a (liblua5.4.so + 0x503a)
                #4  0x00007f498e405723 n/a (liblua5.4.so + 0xd723)
                #5  0x00007f498e405828 lua_error (liblua5.4.so + 0xd828)
                #6  0x00007f498e41d142 luaL_error (liblua5.4.so + 0x25142)
                #7  0x00007f498a27eccc n/a (libwireshark.so.18 + 0x127eccc)
                #8  0x00007f498e40557a n/a (liblua5.4.so + 0xd57a)
                #9  0x00007f498e405f05 lua_callk (liblua5.4.so + 0xdf05)
                #10 0x00007f498a2dbfb7 n/a (libwireshark.so.18 + 0x12dbfb7)
                #11 0x00007f498a317a88 epan_init (libwireshark.so.18 + 0x1317a88)
                #12 0x000055991e0ab78b n/a (/usr/bin/tshark + 0xd78b)
                #13 0x00007f4988a4d6b5 n/a (libc.so.6 + 0x276b5)
                #14 0x00007f4988a4d769 __libc_start_main (libc.so.6 + 0x27769)
                #15 0x000055991e0af8b5 n/a (/usr/bin/tshark + 0x118b5)
                ELF object binary architecture: AMD x86-64

GNU gdb (GDB) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
The target architecture is set to "i386:x86-64".
Reading symbols from /usr/bin/tshark...
Reading symbols from /home/hervey_arch/.cache/debuginfod_client/d362c86f9e10e0e6b1fbfad26c74cc389b54ba8b/debuginfo...
[New LWP 25826]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `/usr/bin/tshark'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=0x6, no_tid=no_tid@entry=0x0) at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
Function(s) ^std::(move|forward|as_const|(__)?addressof) will be skipped when stepping.
Function(s) ^std::(shared|unique)_ptr<.*>::(get|operator) will be skipped when stepping.
Function(s) ^std::(basic_string|vector|array|deque|(forward_)?list|(unordered_|flat_)?(multi)?(map|set)|span)<.*>::(c?r?(begin|end)|front|back|data|size|empty) will be skipped when stepping.
Function(s) ^std::(basic_string|vector|array|deque|span)<.*>::operator.] will be skipped when stepping.
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=0x6, no_tid=no_tid@entry=0x0) at pthread_kill.c:44
#1  0x00007f4988abd813 in __pthread_kill_internal (threadid=<optimized out>, signo=0x6) at pthread_kill.c:89
#2  0x00007f4988a63dc0 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/posix/raise.c:26
#3  0x00007f4988a4b57a in __GI_abort () at abort.c:73
#4  0x00007f498e3fd03a in luaD_throw (L=L@entry=0x55992273a9f8, errcode=<optimized out>, errcode@entry=0x2) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:132
#5  0x00007f498e405723 in luaG_errormsg (L=0x55992273a9f8) at /usr/src/debug/lua/lua-5.4.7/src/ldebug.c:835
#6  0x00007f498e405828 in lua_error (L=<optimized out>) at /usr/src/debug/lua/lua-5.4.7/src/lapi.c:1247
#7  0x00007f498e41d142 in luaL_error (L=0x55992273a9f8, fmt=0x7f498e4301f0 "version mismatch: app. needs %f, Lua core provides %f") at /usr/src/debug/lua/lua-5.4.7/src/lauxlib.c:242
#8  0x00007f498a27eccc in luaopen_bit (L=0x55992273a9f8) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/wslua/lua_bitop.c:164
#9  0x00007f498e40557a in precallC (L=0x55992273a9f8, func=0x55992273a350, nresults=0x0, f=<optimized out>) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:529
#10 luaD_precall (L=L@entry=0x55992273a9f8, func=<optimized out>, nresults=nresults@entry=0x0) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:595
#11 0x00007f498e405f05 in ccall (L=0x55992273a9f8, func=<optimized out>, nResults=0x0, inc=0x10001) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:635
#12 luaD_callnoyield (L=0x55992273a9f8, func=<optimized out>, nResults=0x0) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:655
#13 lua_callk (L=L@entry=0x55992273a9f8, nargs=nargs@entry=0x0, nresults=nresults@entry=0x0, ctx=ctx@entry=0x0, k=k@entry=0x0) at /usr/src/debug/lua/lua-5.4.7/src/lapi.c:1020
#14 0x00007f498a2dbfb7 in wslua_reg_module (name=<synthetic pointer>, L=0x55992273a9f8, func=<optimized out>)
    at /usr/src/debug/wireshark/wireshark-4.4.6/build/epan/wslua/register_wslua.c:10
#15 wslua_register_classes (L=0x55992273a9f8) at /usr/src/debug/wireshark/wireshark-4.4.6/build/epan/wslua/register_wslua.c:48
#16 wslua_init (cb=0x0, client_data=0x0) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/wslua/init_wslua.c:1597
#17 0x00007f498a317a88 in epan_init (cb=cb@entry=0x0, client_data=client_data@entry=0x0, load_plugins=load_plugins@entry=0x1) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/epan.c:344
#18 0x000055991e0ab78b in main (argc=<optimized out>, argv=0x7ffcb7acb9b8) at /usr/src/debug/wireshark/wireshark-4.4.6/tshark.c:1272

I tried to ask one issue in https://gitlab.archlinux.org/archlinux/ … ge_size=20 but my GitLab account is not allowed to that without writing one email to the official team now.

Last edited by swilly (2025-05-28 14:25:56)

Scimmia · 2025-05-28 14:28:18

https://wiki.archlinux.org/title/Wiresh … privileges maybe?

swilly · 2025-05-28 15:08:21

Scimmia wrote:

https://wiki.archlinux.org/title/Wiresh … privileges maybe?

I tried

$ sudo usermod -a -G wireshark hervey_arch
$ id -nG hervey_arch
hervey_arch wheel input lp docker wireshark

but failed again

$ tshark                
zsh: IOT instruction (core dumped)  tshark

Last edited by swilly (2025-05-28 15:09:53)

Scimmia · 2025-05-28 15:11:16

After logging back in?

swilly · 2025-05-28 15:30:25

Scimmia wrote:

After logging back in?

The same log (at least from the same location in tshark.c. Or more specifically, both fails at `luaopen_bit`.)

$ tshark           
zsh: IOT instruction (core dumped)  tshark
$ coredumpctl debug 
           PID: 53297 (tshark)
           UID: 1000 (hervey_arch)
           GID: 1006 (hervey_arch)
        Signal: 6 (ABRT)
     Timestamp: Wed 2025-05-28 23:28:26 CST (5s ago)
  Command Line: tshark
    Executable: /usr/bin/tshark
 Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-org.kde.konsole-1197.scope
          Unit: user@1000.service
     User Unit: app-org.kde.konsole-1197.scope
         Slice: user-1000.slice
     Owner UID: 1000 (hervey_arch)
       Boot ID: fb23f4846bf140e7a0823fd5f0c9bceb
    Machine ID: 2c4a7b6d00d3497792ef5a6c2ccb3af5
      Hostname: CzgArch
       Storage: /var/lib/systemd/coredump/core.tshark.1000.fb23f4846bf140e7a0823fd5f0c9bceb.53297.1748446106000000.zst (present)
  Size on Disk: 11.8M
       Message: Process 53297 (tshark) of user 1000 dumped core.
                
                Stack trace of thread 53297:
                #0  0x00007f92ef0fe74c n/a (libc.so.6 + 0x9774c)
                #1  0x00007f92ef0a4dc0 raise (libc.so.6 + 0x3ddc0)
                #2  0x00007f92ef08c57a abort (libc.so.6 + 0x2557a)
                #3  0x00007f92f4a6603a n/a (liblua5.4.so + 0x503a)
                #4  0x00007f92f4a6e723 n/a (liblua5.4.so + 0xd723)
                #5  0x00007f92f4a6e828 lua_error (liblua5.4.so + 0xd828)
                #6  0x00007f92f4a86142 luaL_error (liblua5.4.so + 0x25142)
                #7  0x00007f92f087eccc n/a (libwireshark.so.18 + 0x127eccc)
                #8  0x00007f92f4a6e57a n/a (liblua5.4.so + 0xd57a)
                #9  0x00007f92f4a6ef05 lua_callk (liblua5.4.so + 0xdf05)
                #10 0x00007f92f08dbfb7 n/a (libwireshark.so.18 + 0x12dbfb7)
                #11 0x00007f92f0917a88 epan_init (libwireshark.so.18 + 0x1317a88)
                #12 0x000055ae704e078b n/a (/usr/bin/tshark + 0xd78b)
                #13 0x00007f92ef08e6b5 n/a (libc.so.6 + 0x276b5)
                #14 0x00007f92ef08e769 __libc_start_main (libc.so.6 + 0x27769)
                #15 0x000055ae704e48b5 n/a (/usr/bin/tshark + 0x118b5)
                ELF object binary architecture: AMD x86-64

GNU gdb (GDB) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
The target architecture is set to "i386:x86-64".
Reading symbols from /usr/bin/tshark...
Reading symbols from /home/hervey_arch/.cache/debuginfod_client/d362c86f9e10e0e6b1fbfad26c74cc389b54ba8b/debuginfo...
[New LWP 53297]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `/usr/bin/tshark'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=0x6, no_tid=no_tid@entry=0x0) at pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
Function(s) ^std::(move|forward|as_const|(__)?addressof) will be skipped when stepping.
Function(s) ^std::(shared|unique)_ptr<.*>::(get|operator) will be skipped when stepping.
Function(s) ^std::(basic_string|vector|array|deque|(forward_)?list|(unordered_|flat_)?(multi)?(map|set)|span)<.*>::(c?r?(begin|end)|front|back|data|size|empty) will be skipped when stepping.
Function(s) ^std::(basic_string|vector|array|deque|span)<.*>::operator.] will be skipped when stepping.
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=0x6, no_tid=no_tid@entry=0x0) at pthread_kill.c:44
#1  0x00007f92ef0fe813 in __pthread_kill_internal (threadid=<optimized out>, signo=0x6) at pthread_kill.c:89
#2  0x00007f92ef0a4dc0 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/posix/raise.c:26
#3  0x00007f92ef08c57a in __GI_abort () at abort.c:73
#4  0x00007f92f4a6603a in luaD_throw (L=L@entry=0x55ae70eb49f8, errcode=<optimized out>, errcode@entry=0x2) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:132
#5  0x00007f92f4a6e723 in luaG_errormsg (L=0x55ae70eb49f8) at /usr/src/debug/lua/lua-5.4.7/src/ldebug.c:835
#6  0x00007f92f4a6e828 in lua_error (L=<optimized out>) at /usr/src/debug/lua/lua-5.4.7/src/lapi.c:1247
#7  0x00007f92f4a86142 in luaL_error (L=0x55ae70eb49f8, fmt=0x7f92f4a991f0 "version mismatch: app. needs %f, Lua core provides %f") at /usr/src/debug/lua/lua-5.4.7/src/lauxlib.c:242
#8  0x00007f92f087eccc in luaopen_bit (L=0x55ae70eb49f8) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/wslua/lua_bitop.c:164
#9  0x00007f92f4a6e57a in precallC (L=0x55ae70eb49f8, func=0x55ae70eb4350, nresults=0x0, f=<optimized out>) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:529
#10 luaD_precall (L=L@entry=0x55ae70eb49f8, func=<optimized out>, nresults=nresults@entry=0x0) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:595
#11 0x00007f92f4a6ef05 in ccall (L=0x55ae70eb49f8, func=<optimized out>, nResults=0x0, inc=0x10001) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:635
#12 luaD_callnoyield (L=0x55ae70eb49f8, func=<optimized out>, nResults=0x0) at /usr/src/debug/lua/lua-5.4.7/src/ldo.c:655
#13 lua_callk (L=L@entry=0x55ae70eb49f8, nargs=nargs@entry=0x0, nresults=nresults@entry=0x0, ctx=ctx@entry=0x0, k=k@entry=0x0) at /usr/src/debug/lua/lua-5.4.7/src/lapi.c:1020
#14 0x00007f92f08dbfb7 in wslua_reg_module (name=<synthetic pointer>, L=0x55ae70eb49f8, func=<optimized out>)
    at /usr/src/debug/wireshark/wireshark-4.4.6/build/epan/wslua/register_wslua.c:10
#15 wslua_register_classes (L=0x55ae70eb49f8) at /usr/src/debug/wireshark/wireshark-4.4.6/build/epan/wslua/register_wslua.c:48
#16 wslua_init (cb=0x0, client_data=0x0) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/wslua/init_wslua.c:1597
#17 0x00007f92f0917a88 in epan_init (cb=cb@entry=0x0, client_data=client_data@entry=0x0, load_plugins=load_plugins@entry=0x1) at /usr/src/debug/wireshark/wireshark-4.4.6/epan/epan.c:344
#18 0x000055ae704e078b in main (argc=<optimized out>, argv=0x7ffc2ddf19c8) at /usr/src/debug/wireshark/wireshark-4.4.6/tshark.c:1272

With more check, I found the problem seems to be "luaL_error (L=0x55ae70eb49f8, fmt=0x7f92f4a991f0 "version mismatch: app. needs %f, Lua core provides %f")".

Then I found tshark is linked to 2 lua's

$ ldd /usr/bin/tshark| grep lua
        /usr/lib/liblua5.4.so (0x00007f92e4ded000)
        liblua5.3.so.5.3 => /usr/lib/liblua5.3.so.5.3 (0x00007f92dedc1000)
$ yay -Qs lua
local/lua 5.4.7-1
    Powerful lightweight programming language designed for extending applications
local/lua53 5.3.6-3
    Powerful lightweight programming language designed for extending applications
local/luajit 2.1.1741730670-1
    Just-in-time compiler and drop-in replacement for Lua 5.1
$ yay -Qi lua53 | grep Required
Required By     : wireshark-cli

So the problem seems to be we should forbid tshark to use liblua5.4.so. But that is needed by many other things

$ yay -Qi lua | grep Required
Required By     : librime  telegram-cli-git  vlc  wireplumber  wireshark-cli

So I chose to install wireshark-cli manually instead of yay

$ git clone https://gitlab.archlinux.org/archlinux/packaging/packages/wireshark.git
$ cd wireshark
$ vim PKGBUILD # change lua53 to lua
# https://bbs.archlinux.org/viewtopic.php?id=260452 compile all and then install partially
$ makepkg -s
# https://bbs.archlinux.org/viewtopic.php?pid=1935636#p1935636
$ sudo pacman -U wireshark-cli-4.4.6-2-x86_64.pkg.tar.zst
$ ldd /usr/bin/tshark| grep lua                          
        /usr/lib/liblua5.4.so (0x00007fc08865e000)

Now the error becomes

$ id -nG hervey_arch | grep wireshark
hervey_arch wheel input lp docker wireshark
$ tshark           
Capturing on 'Cisco remote capture: ciscodump'
tshark: Couldn't run dumpcap in child process: Permission denied
tshark: Error from extcap pipe:  ** (ciscodump:112608) 01:38:55.703688 [ciscodump WARNING] extcap/ciscodump.c:2482 -- main(): Missing parameter: --remote-host

0 packets captured
$ id -nG hervey_arch                                     
hervey_arch wheel input lp docker wireshark
# same as PKGBUILD config for /usr/bin/dumpcap
$ id -G hervey_arch
1006 998 994 991 964 150
$ ls -al /usr/bin/dumpcap
-rwxr-xr-- 1 root wireshark 243984 May 29 00:45 /usr/bin/dumpcap

---

The problem in the last block goes after reboot. Thanks for Scimmia's help.

I don't know the reasons for why we need reboot to work. If someone knows, please tell me. Thanks in advance.

Last edited by swilly (2025-05-29 05:47:09)

Arch Linux

#1 2025-05-28 14:22:05

Wireshark failure to run

#2 2025-05-28 14:28:18

Re: Wireshark failure to run

#3 2025-05-28 15:08:21

Re: Wireshark failure to run

#4 2025-05-28 15:11:16

Re: Wireshark failure to run

#5 2025-05-28 15:30:25

Re: Wireshark failure to run

Board footer