Wireshark · Wireshark-users: Re: [Wireshark-users] tshark and /tmp/etherXXXX files

["Luis EG Ontanon" <luis@xxxxxxxxxxx>]

Lets get on this:

What are the perms on:
- /tmp
- the /tmp/XXXX files while capturing
- the /tmp/XXXX files once left there

Are you running as root or as an unpriviledged user [ id -a ]?
What's your [ umask ]?

\Lego


On Mon, Jul 21, 2008 at 5:43 AM, Dan Murphy <danmurphy@xxxxxxxxx> wrote:
> I'm running CentOS 5.0 X64 on all these hosts.
> #uname -a
> Linux lmon1.mia1.plx 2.6.18-8.1.15.el5 #1 SMP Mon Oct 22 08:32:28 EDT 2007
> x86_64 x86_64 x86_64 GNU/Linux
>
> No matter how it exits it leaves
> these files behind.  I pasted this in a previous email but even just running
> it like this:
> #tshark -ni eth5 -c 5
> It captures 5 packets then exists cleanly leaving the temp file behind.  If
> I don't use the count
> and just ^C it leaves them behind as well.
>
>
> Thanks,
> Dan
>
> On Sun, Jul 20, 2008 at 11:28 PM, Stephen Fisher <stephentfisher@xxxxxxxxx>
> wrote:
>>
>> On Sat, Jul 19, 2008 at 12:26:46PM -0400, Dan Murphy wrote:
>>
>> > Am I the only person that has reported this behavior or the only
>> > person that it's actually become an issue for?  Is this the expected
>> > behavior of tshark?
>>
>> Wireshark/tshark is supposed to clean up these temporary files after it
>> is done with them.  They've been a part of Wireshark/Ethereal for a long
>> time, including version 0.99.5.  I don't see the problem on my system,
>> although it is saving the temporary files into /var/tmp instead of /tmp
>> as in your case.  How are you terminating tshark?  A ^C for me allows
>> for the cleanup of the temporary file.  What type of Unix are you
>> running?
>>
>>
>> Steve
>> _______________________________________________
>> Wireshark-users mailing list
>> Wireshark-users@xxxxxxxxxxxxx
>> https://wireshark.org/mailman/listinfo/wireshark-users
>
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>
>



-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan