Wireshark · Wireshark-dev: Re: [Wireshark-dev] Devices in tshark versus dumpcap

[Gisle Vanem <gisle.vanem@xxxxxxxxx>]

Graham Bloice wrote:

> Which branch though, master or master-2.2?

'master' it seems. But I tried to resolve the issue myself.
First by trying w/o HAVE_EXTCAP (to exclude any problems with that). But
that is impossible. E.g.:
  capture_sync.c(521): error C2039: 'extcap_fifo': is not a member of 'interface_options_tag'
etc. etc.

The is for sure a problem in how lines of text are generated in dumpcap.exe
and how tshark is interpreting them. I'm not even sure the lines have
"\r\n" terminations since from dumpcap.c:
  #ifdef _WIN32
          /* set output pipe to binary mode, to avoid ugly text conversions */
          _setmode(2, O_BINARY);

And in capchild/capture_ifinfo.c:
  raw_list = g_strsplit(data, "\r\n", 0);

Can you (or someone else) send the output of:
  tshark.exe -o console.log.level:252 -D

So I can guess what's wrong here?

--
--gv