https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2769
--- Comment #2 from Guy Harris <guy@xxxxxxxxxxxx> 2010-03-04 17:44:56 PST ---
Or, for the benefit of Windows users:
http://msdn.microsoft.com/en-us/library/aa272686(VS.60).aspx
If the sending process is using the "standard I/O library" routines to write to
its standard output, then it needs to fflush() the standard output
("fflush(stdout)") before it blocks waiting for input (packets to arrive, or
whatever), so that TShark (or tcpdump/WinDump, or whatever's reading from the
sending process) sees those packets. Otherwise, the last part of the packet
data written to the standard output might be buffered in memory in the sending
process, and not sent out until more data is written to the standard output or
the standard output is closed.
And if you want to send packets one at a time to TShark and get the PDML for
each packet before you send the next packet, you need to fflush the standard
output after each packet.
If that *still* doesn't fix the problem, show us the sending program - or a
simplified version that exhibits the same behavior - so that we can see why
TShark isn't seeing the packet as soon as it's all written to the pipe.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.