Wireshark · Ethereal-dev: Re: [Ethereal-dev] selecting capture encoding in wiretap

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Sat, Oct 28, 2000 at 11:14:20PM +0300, Paul Ionescu wrote:
> Another problem:
> I want to capture from a named pipe or stdin ("ethereal -i -"). It works
> ONLY if the data from stdin or pipe is in libpcap format.
> If I want to live capture from a pppdump trace ( tail -f /pppdump |
> ethereal -i - ), it does not work.

Unfortunately, the code to determine the capture type currently works
by, for each possible file type, seeking back to the beginning of the
file and trying to read the file, which doesn't work on pipes.

However, with some work, it might be possible to buffer data being read
from the file in such a fashion as to allow any backward seeking to be
done entirely within a buffer maintained by wiretap, without having to
do a backwards seek on the file itself; this would allow most file types
- those that have a magic number or have some other small chunk of data
at the beginning of the file that is read and checked to see if it makes
sense for that type of file - to be autodetected even when read from a
pipe.  With enough buffering, it could even work on the ones that have
to get run through a YACC parser.