That depends on how it's killed.
On UN*X, sending it SIGTERM, with, for example, the "kill" command,
will cause it to cleanly exit, flushing out the buffered packets.
Sending it a SIGINT by, for example, typing ^C to it while it's
running in the foreground will also cause it to cleanly exit.
However, by our previous experience with Ethereal, the "kill" command can only cleanly stop tshark sometimes. Many other times the packets were not correctly flushed out.
So this has been improved in Wireshark over Ethereal?
On Windows, currently the only way to get it to cleanly exit is to
send it a "control-C event"; I don't know whether there's any way to
do that other than to type ^C to it while it's running.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe