Ethereal-dev: Re: [Ethereal-dev] How To have tethereal -r - read from STDIN?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 12 Jul 2002 18:21:10 -0700
On Fri, Jul 12, 2002 at 06:12:49PM -0700, Jaime Fournier wrote:
> Just a quick question if it was easy to modify
> tethereal to read from STDIN.

Sure, as long as the standard input isn't a pipe.

Unfortunately, if it *is* reading from a pipe - whether it's the
standard input or not - that won't work, because the library that
Ethereal and Tethereal use to read captures does some heuristics on
libpcap files to find out which of the various normal or mutant forms of
libpcap file it is, and those heuristics involve reading the same part
of the file multiple times.

> We have some devices on AIX that TCPDUMP can read from
> fine, but libpcap does not support.
> Would like to be able to read from a pipe.
> 
> Thanks in advance, for any ideas.

You'd either have to disable those heuristics when reading from a
non-seekable file, or do the "reading the same part of the file multiple
times" with some form of internal buffering so that it only has to read
the data once from the file.