Wireshark · Ethereal-dev: Re: [Ethereal-dev] Reading a capture file from stdin is really working?!?

[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:

> Isn't that it is exactly how it should work?
>  -r for random access
>  -i for sequential access.

Tethereal *itself* doesn't need random access.  It's Wiretap that needs 
it, to handle the checks to figure out what type of file it's reading.

If we did our own buffering in Wiretap (in addition to, or instead of, 
the buffering done by the "standard I/O library" routines), and arranged 
that seeks *within* a buffer were done by using existing stuff in the 
buffer, then, with a sufficiently large buffer, we could probably 
support reading sequentially from a pipe.  The buffer might have to be 
relatively big, for the heuristic file readers, which might have to read 
a significant amount of the file to be sure of the type, and for the 
libpcap reader, which has to determine which of various flavors of 
libpcap, sharing the same magic number, the file is.