Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-users] capture from a fifo

[Richard van der Hoff <richardv@xxxxxxxxxxxxx>]

[Moving this to the dev list...]

Richard van der Hoff wrote:
> Has wireshark stopped supporting capture from a fifo recently?
>
> I'm sure I used to be able to do things like the following:
>
> $ mkfifo fifo
> $ (cat cap; sleep 5; cat cap) > fifo &
> $ tshark -i fifo
>
> But it now dies after the first batch of packets with "tshark: Error 
> while capturing packets: Error reading from pipe: Resource temporarily 
> unavailable".

I've now tracked this down. Interestingly it's limited to tshark, which 
might help explain why nobody else has noticed it.

The problem is that tshark now uses the capture_loop stuff, which is 
written to use non-blocking I/O on fifos; however, (unlike dumpcap) 
tshark doesn't do a select() on the file descriptor to check input is 
available before reading.

Ulf - I notice you made the relevant change here (r16787) - is there any 
reason why tshark shouldn't use capture_loop_dispatch to do its 
processing, rather than attempting to use cap_pipe_dispatch or 
pcap_dispatch directly?

Cheers

Richard