Wireshark · Ethereal-dev: Re: [Ethereal-dev] ERTSP: Ethereal's RemoTe Sniffing Protocol

[Guy Harris <gharris@xxxxxxxxx>]

ronnie sahlberg wrote:

> tehtereal -w- | tethereal -r-
> does not work since tehtereal seems to want seek on the input file for
> some reason.

It wants to determine the file type, which is done by trying to read it 
as various file types.

If Wiretap buffered data internally, so that backward seeks to the 
beginning of the file could be implemented by going back to the 
beginning of the buffer (as long as no more data than fits in the buffer 
had been read from the file), Tethereal could read from a pipe.

The "-i -" trick works because, in that case, it assumes the file is in 
standard libpcap format, rather than trying to determine the file type.