Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 5982] Feature-request: Please support live-capture from saved pcap file

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5982

Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #9263|                            |review_for_checkin?
              Flags|                            |

--- Comment #10 from Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> 2012-10-02 03:33:13 PDT ---
Created attachment 9263
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=9263
Support for tailing regular files

Proof of concept, works for me.

Right now it doesn't support file truncation (like tail program do),
and use busy waiting instead of waiting for inotify/FSEvents events.

It's little hacky (I'm not familiar with dumpcap sources), please review.

PS: after patching you can use dumpcap to do pcap file merging: 
 $ dumpcap -i /tmp/a.pcap -i /tmp/b.pcap -i /tmp/c.pcap
Or read all files in tshark:
 ./tshark -i /tmp/a.pcap -i /tmp/b.pcap -i /tmp/c.pcap

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.