On Wed, Feb 20, 2002 at 03:32:55PM +0800, a wrote:
> (A) Don't exit after decode
> (B) Can receive original packets from stdin
Tethereal doesn't exit until it's finished reading the capture file.
If it were to support reading from a pipe (which is doable, but isn't
trivial, as the mechanisms it uses to figure out what type of capture
file it's reading currently involves seeks), and it were reading from a
pipe, it wouldn't exit until it got an EOF from the pipe (just as it
currently doesn't exit until it gets an end-of-file from the file it's
reading).
It would not make sense for it to keep running after it got an EOF from
the pipe, however, as there's nothing more for it to read, and therefore
nothing more for it to do, so that's obviously *not* what you mean by
"don't exit after decode"; given that, what do you mean by "don't exit
after decode"?
(Note that some capture file formats intrinsically require seeking to
read them at all, e.g. Network Monitor and NetXRay/Windows Sniffer
format; therefore, Tethereal will probably never support reading them
from a pipe. libpcap format doesn't require seeking, although the way
we determine which of the N different flavors of libpcap format the file
is currently done with seeks; we'd have to do some form of buffering to
avoid the seeks, but that'd also allow us to use our code to do captures
from pipes in Ethereal as well, rather than duplicating the code in
"capture.c".)