Wireshark · Wireshark-users: Re: [Wireshark-users] Various instances of wireshark reading from various named pipes

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 3, 2006, at 3:30 AM, Janssens, Kitty wrote:

> Could this be a bug ?

Possibly, but it might be a bug in your program.  As I said in the bug:

Are you absolutely certain that *no* process is holding pipe A open?   
Does your
program, for example, fork and exec (or otherwise spawn) other  
programs while
it holds pipe A open?

If so, *those* processes might be holding the pipe open, even if your  
program
isn't.

(Note that unlinking the pipe makes no difference; if you unlink a  
file on a
UN*X and some process on the same machine has the file open, the link  
goes away
immediately but the file itself doesn't go away until the last open of  
the file
is closed.)

The only way in which one instance of Wireshark can be prevented from  
stopping
its capture by another instance of Wireshark would be if one of those  
instances
happened (perhaps by virtue of being run from your program, for  
example) to
have an open file descriptor for the write side of the other  
instances's input
pipe - the write side won't be closed until your program *and* that  
instance of
Wireshark close it, and, as that instance of Wireshark doesn't even  
know it
*has* an open file descriptor for the pipe if it inherited it from the  
parent
process, it's unlikely to close it until it exits.