Kali 2016.1 - wireshark crashing on launch in xrdp

[binarypearl]

I currently have a Kali 2016.1 system, and am trying to use xrdp. One of the issues that I ran into is that Wireshark crashes when trying to start it while in the xrdp session. Wireshark runs successfully at the VMware console.

The error messages that I am getting are:

Qt: XKEYBOARD extension not present on the X server.
The X11 connection broke: Maximum allowed requested length exceeded (code 4)
XIO: fatal IO error 9 (Success) on X server ":11.0"
after 195 requests (195 known processed) with 0 events remaining.

I am able to run wireshark successfully through xrdp in Kali 2.0.

One of the modifications that was needed was to change "max_bpp=24" to "max_bpp=16" in /etc/xrdp/xrdp.ini. Otherwise the window manager would crash on login. The other change I had made here is to change "X11DisplayOffset" in /etc/xrdp/sesman.ini". This was just done for troubleshooting. In /root/.xsession (or any other users $HOME/.xsession) I have 'xfce4-session'.

One other thing to note, on 2016.1, when I xrdp in, my session doesn't show up in `w` or `who`. This might be a separate issue, but wanted to point it out in case this could be pointing to what's going on.

Any ideas on what could be happening? The closet thing I could find on a google search was on the 'Qt: XKEYBOARD error message' is something about an icon size being too large, but that was more of someone trying to compile a QT app and getting the error message.

If there are any other details that I can provide, please let me know, thanks!

--Shaun

[mtamplier]

I have the same problem.

[gotitservices]

I'm pretty sure wire shark puts the network card into promiscuous mode to catch all network traffic. You can't scan with the same network device that you're remotely connected through, otherwise you'll get disconnected every time. I'm pretty sure to scan a network while accessing the computer remotely you need two connections to that network. I don't know if it will work, but you could try aliasing your network device and using that interface to scan:

ifconfig eth0:0 up
ifconfig eth0:0 192.168.1.50 netmask 255.255.255.0 broadcast 192.168.1.255

if you need access to the internet on this interface

route add default gateway 192.168.1.1

change the network information to match your target network

[zakrzu]

Has anyone found a solution?

[akgosec]

same problem here. I use tshark now

[arsenic]

Use wireshark-gtk instead.