Wireshark · Ethereal-dev: Re: [Ethereal-dev] Reading a capture file from stdin is really working?!?

[Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>]

Hi Ulf,

the following works on Mac OS X:

[PowerBook:~/Desktop] tuexen% cat icmp1.pcap | tethereal -i - -w ./ 
testout.pcap
Capturing on -
2

Reading from a 'file' does not:

[PowerBook:~/Desktop] tuexen% cat icmp1.pcap | tethereal -r - -w ./ 
testout.pcap
tethereal: The file "-" could not be opened: Illegal seek.

The same is if I use named pipe: -i works, -r doesn't.

Best regards
Michael

On Jan 7, 2006, at 1:28 PM, Ulf Lamping wrote:

> Hi List!
>
> I'm wondering, if reading (not capturing) from a stdin is actually  
> working?!?
>
> I've found some parts in the sources which suggests that it's  
> implemented.
>
> But for example:
>
> cat -B dhcp.pcap | ./tethereal -r - -w ./testout.pcap
>
> doesn't seem to work, as reading a capture file requires to seek to  
> the start of a capture file. As it isn't possible for a pipe to  
> seek, this must fail.
>
> There are a lot of file_seek() calls in the wtap_open_offline() and  
> the various sub functions (e.g. libpcap_open), so I don't think  
> this will work.
>
> Do I miss a point here?
>
> Regards, ULFL
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev