[Moving this to the dev list...]
Richard van der Hoff wrote:
Has wireshark stopped supporting capture from a fifo recently?
I'm sure I used to be able to do things like the following:
$ mkfifo fifo
$ (cat cap; sleep 5; cat cap) > fifo &
$ tshark -i fifo
But it now dies after the first batch of packets with "tshark: Error
while capturing packets: Error reading from pipe: Resource temporarily
unavailable".
I've now tracked this down. Interestingly it's limited to tshark, which
might help explain why nobody else has noticed it.
The problem is that tshark now uses the capture_loop stuff, which is
written to use non-blocking I/O on fifos; however, (unlike dumpcap)
tshark doesn't do a select() on the file descriptor to check input is
available before reading.
Ulf - I notice you made the relevant change here (r16787) - is there any
reason why tshark shouldn't use capture_loop_dispatch to do its
processing, rather than attempting to use cap_pipe_dispatch or
pcap_dispatch directly?
Cheers
Richard