Sorry I am answering a bit late, but I hope the response is still useful.
On 9/2/05, Jayanna, Jay <jjayanna@xxxxxxxxxxxx
> wrote:
I am trying to read packets from a pipe
with -i option. I am able to capture the first time without any
problems both with ethereal & tethereal. But if I stop capturing
while packets are still written to the pipe, I get sigpipe error. My handler catches it, closes the pipe
& reopens it for writing again. When I try to start capturing
again, tethereal works fine & starts the capyure without any
problem but if I try the same with ethereal, I get the message
"Unrecognized libpcap format", though I specify the libpcap format just
before reopening the pipe.
Tethereal recognizes the format but for some reason, ethereal doesn't.
I am running the program on linux machine & using ethereal version
0.10.12. Does anyone in this forum have any idea about this? Any help
is greatly appreciated.
Actually,
I had a similar problem. I did not detect the sigpipe error, but I also
tried to restart a capture, put a new header in the pipe etc. It seems
like ethereal does not like that, at least I did have to restart
ethereal before it would work again. So my money is on this being a bug
in ethereal.
Can you explain under which circumstances the writing application can
detect that ethereal is not reading the pipe any more? Does that only
work when data is written, or does it also work during "idle" periods?
I still favour my approach a restarting a user configured child process
for the capture itself. I think it is conceptually a lot clearer and
more powerful than the current situation of two different reading
methods. I posted the patch to the mailing list: give it a try, maybe
it works for you.
Thomas