On Wed, Jun 07, 2000 at 04:15:44PM -0500, Jim Wildman wrote:
>
>
> On HPUX (due to the libpcap problems) ethereal can't see all of the
> packets (or just crashes). It can, however read the output of HP's
> nettl command, after you stuff that output into a file.
>
> So, can ethereal be coaxed into reading packet info from the stdin?
Have you traced the crash to libpcap or Ethereal? Any info would be
helpful to either group, either us or the folks at www.tcpdump.org.
But, no, stdin won't work. Ethereal makes a first pass through a trace
file and reads all the frames. That gives you the list of frames in the
top pane of the GUI. Each frame's location in the file is remembered.
After that, when you click on a frame's row in the GUI list, the file
is read in a random-access fashion (ignoring what zlib has to do to go backwards
in a trace gzipped file...) to read that packet. So, the random-access
reading is incompatible with the stdin stream.
> What exactly does the -S option do?
That's the "update packets in real time" option that goes along with
the -k command-line option.
--gilbert