One time, my friend and coworker Oliver asked me not to open a bug report right away when I found out that a specific packet could crash the “color coding” code.

Repeat until you have the smallest file possible to reproduce the crash (which often enough is just a single packet). The process itself is simple but can take some time – I usually use editcap to split the crashing pcap file into smaller files, either by specifying the number of packets per file I want with the “-c” parameter, or by start and stop time stamps via “-A” and “-B” parameters. Now, when it comes to crashing Wireshark on purpose I have done that a few times, mostly to find the reason for it and open a bug report. And I don’t know any protocol analyzer that’s doing it any better than Wireshark does. But that’s something you have to live with, because it’s a really complex task to dissect and diagnose all those protocols. It’s an awesome tool to find out what is happening in those packets, even though it is not always 100% correct on what it shows. Well, technically it was still Ethereal back then, and I sometimes ran it in form of the now long forgotten Packetyzer because it looked nicer on Windows. I am using Wireshark almost every day (yes, Weekends, too), and have been for the last 15 years. So let’s take a look at what that means and what can be done about it.

Every once in a while there is some news about Wireshark being vulnerable to being attacked/exploited/pwned, meaning that there is a way to craft frames/packets in a pcap/pcapng file to make Wireshark crash and (if done right) execute malicious code.

Is wireshark safe