Wireshark · Ethereal-dev: Re: [Ethereal-dev] Reading a capture file from stdin is really working?!?

[LEGO <luis.ontanon@xxxxxxxxx>]

On 1/7/06, Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx> wrote:
> Hi Ulf,
>
> the following works on Mac OS X:
>
> [PowerBook:~/Desktop] tuexen% cat icmp1.pcap | tethereal -i - -w ./
> testout.pcap
> Capturing on -
> 2
>
> Reading from a 'file' does not:
>
> [PowerBook:~/Desktop] tuexen% cat icmp1.pcap | tethereal -r - -w ./
> testout.pcap
> tethereal: The file "-" could not be opened: Illegal seek.
>
> The same is if I use named pipe: -i works, -r doesn't.
>
> Best regards
> Michael
>
> On Jan 7, 2006, at 1:28 PM, Ulf Lamping wrote:
>
> > Hi List!
> >
> > I'm wondering, if reading (not capturing) from a stdin is actually
> > working?!?
> >
> > I've found some parts in the sources which suggests that it's
> > implemented.
> >
> > But for example:
> >
> > cat -B dhcp.pcap | ./tethereal -r - -w ./testout.pcap
> >
> > doesn't seem to work, as reading a capture file requires to seek to
> > the start of a capture file. As it isn't possible for a pipe to
> > seek, this must fail.
> >
> > There are a lot of file_seek() calls in the wtap_open_offline() and
> > the various sub functions (e.g. libpcap_open), so I don't think
> > this will work.
> >
> > Do I miss a point here?

Isn't that it is exactly how it should work?
 -r for random access
 -i for sequential access.

> > Regards, ULFL
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan