https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5445
--- Comment #15 from Guy Harris <guy@xxxxxxxxxxxx> 2011-01-09 20:52:46 PST ---
We don't support running the dissectors when writing to a pipe; this rules out
tap listeners and printing dissected packet information. This is because,
currently, writing to a file with "-w" is done by dumpcap, not TShark, and, if
it needs to dissect the packets, TShark then has to read from the file that's
being written to by dumpcap, and it can't do that.
Now, if we could arrange that TShark not even try dissecting the packets when
you do something such as
./tshark -r test/dhcp.pcap -w - > foo
it might be possible to avoid running the taps in that case as well.
The trick might be to have multiple types of taps, such as ones that produce no
output, and are allowed to be unconditionally run, and ones that produce
output, which are not allowed to be unconditionally run. Dissection will be
forced on in TShark if one of the latter type of taps is listening, but will
not be forced on if only the former type of taps is listening.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.