Wireshark · Wireshark-dev: Re: [Wireshark-dev] explicitly stop capture with Tshark

[Guy Harris <guy@xxxxxxxxxxxx>]

On Feb 4, 2009, at 6:50 PM, Joshua (Shiwei) Zhao wrote:

> However, by our previous experience with Ethereal, the "kill"  
> command can only cleanly stop tshark sometimes. Many other times the  
> packets were not correctly flushed out.
> So this has been improved in Wireshark over Ethereal?

As "Wireshark" is the name that {the program Gerald Combs started} had  
starting with the 0.99.2 release, and "Ethereal" is the name that {the  
program Gerald Combs started} had prior to the 0.99.2 release:

	http://www.wireshark.org/faq.html#q1.2

the question is more correctly stated as

	So this has been improved since {whatever pre-0.99.2 release you were  
using} of {the program Gerald Combs started}?

The answer is "it might well have".

If, on UN*X, you use the kill command with only a process-ID argument,  
or with "-TERM" and a process-ID argument (which means typing 6 more  
characters than you need, as the default signal sent by kill is  
SIGTERM), or (on most if not all UN*Xes) with the "-15" argument (if  
SIGTERM is 15 on your UN*X, as it is on most UN*Xes - that's still 4  
more characters than you need type), to terminate tshark, then, if the  
packets aren't correctly flushed out, that's a bug, and should be  
reported as such.  There may have been bugs of that sort that were  
fixed at some point after whatever release of Ethereal you were using.