Ethereal-dev: Re: [Ethereal-dev] Problem with capturing from a named pipe

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Thomas Steffen <steffen.list.account@xxxxxxxxx>
Date: Tue, 27 Sep 2005 22:09:28 +0200
Sorry I am answering a bit late, but I hope the response is still useful.

On 9/2/05, Jayanna, Jay <jjayanna@xxxxxxxxxxxx > wrote:

I am trying to read packets from a pipe with -i option. I am able to capture the first time without any problems both with ethereal & tethereal. But if I stop capturing while packets are still written to the pipe, I get sigpipe error. My handler catches it, closes the pipe & reopens it for writing again. When I try to start capturing again, tethereal works fine & starts the capyure without any problem but if I try the same with ethereal, I get the message "Unrecognized libpcap format", though I specify the libpcap format just before reopening the pipe. Tethereal recognizes the format but for some reason, ethereal doesn't. I am running the program on linux machine & using ethereal version 0.10.12. Does anyone in this forum have any idea about this? Any help is greatly appreciated.

Actually, I had a similar problem. I did not detect the sigpipe error, but I also tried to restart a capture, put a new header in the pipe etc. It seems like ethereal does not like that, at least I did have to restart ethereal before it would work again. So my money is on this being a bug in ethereal.

Can you explain under which circumstances the writing application can detect that ethereal is not reading the pipe any more? Does that only work when data is written, or does it also work during "idle" periods?

I still favour my approach a restarting a user configured child process for the capture itself. I think it is conceptually a lot clearer and more powerful than the current situation of two different reading methods. I posted the patch to the mailing list: give it a try, maybe it works for you.

Thomas