https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1650
--- Comment #8 from Guy Harris <guy@xxxxxxxxxxxx> 2011-12-08 11:37:43 PST ---
Bug 2743 suggests passing packets from dumpcap to *T*Shark, *IF* no "-w" flag
was specified to TShark, via a pipe. It doesn't suggest passing packets from
dumpcap to Wireshark using a pipe, nor does it suggest passing packets from
dumpcap to TShark using a pipe when "-w" is specified - i.e., it doesn't
suggest leaving the job of writing packets to a file entirely to Wireshark or
TShark.
Actively following a capture that's being written to multiple files is
problematic, as Wireshark, at least, can have only one file open. It's even
more complicated when the capture is being written to a ring buffer of files,
because the files can disappear out from under *Shark. We should probably
rethink what the semantics of ring buffers in Wireshark and TShark should be.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.