Since latest upgrade, I get following error when trying to start tshark :
tshark: Couldn't load plugin 'l16mono.so': /usr/local/lib/wireshark/plugins/2.6/wiretap/l16mono.so: Undefined symbol "register_codec" Capturing on 'lo0'
tshark: Couldn't run /usr/local/bin/dumpcap in child process: No such file or directory
Indeed dumpcap disappeared.
Yeah, it went away with ports r468767 which mentions:
Also note: The -lite ports were made lighter with the removal of dumpcap.
I tried simply tweaking the Makefile to put dumpcap back in where it was removed, but that failed.
Ended up just building the non-lite version of tshark - it still shows the warning about l16mono.so, but seems to work otherwise.
Created attachment 193621 [details]
wireshark l16mono fix
are patched from upstream:
plugins/codecs/l16_mono/Makefile.in - updated with automake
(In reply to freebsd from comment #0)
It's upstream bug: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14638
Could you test attached patch? Fixes "l16mono.so: Undefined symbol" for me.
A commit references this bug:
Date: Mon May 28 19:30:58 UTC 2018
New revision: 471063
Fix an undefined symbol error in tshark.
The l16mono codec was installed as a regular plugin, and this generated a bogus undefined symbol error.
Submitted by: Sergey Akhmatov <email@example.com>
Obtained from: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14638
While this bug is closed, I hope someone still reads if I comment - I just ran into the same issue with tshark-lite 3.0.2_1 - "it does not work because dumpcap is missing".
So what is the answer on this? Phrased differently: what makes the "lite" package "lite"? If it's just the removal of being able to capture, maybe this should be stated more clearly in the package info...
Sure, I see the comments. But your issue sounds very different from this bug. The intent is not to make tshark-lite useless. Please open a new PR for your issues.
(In reply to Joe Marcus Clarke from comment #7)
Well, the title of this bug is "net/tshark-lite ... missing ... dumpcap", which is still the case with 3.0.x - so I found it "close enough".
The symbol issue is fixed, I understand.
Anyway. I'll open a new PR.