Wireshark-dev: [Wireshark-dev] tshark hungs

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Mani <vmanikandan.gct@xxxxxxxxx>
Date: Wed, 30 May 2012 21:11:29 +0530
Hi,

  I am using tshark 1.6.8 (FC14) to capture 802.11 frames

  /usr/sbin/tshark -q -i wlan0 -w /var/tmp/tshark.out.wlan0 & (running it in background)

 After some time, trying to stop the capture using 

 kill TERM <PID>

 strace of process says

read(4, 0xbff18b08, 4)                  = ? ERESTARTSYS (To be restarted)
--- SIGTERM (Terminated) @ 0 (0) ---
sigreturn()                             = ? (mask now [])
read(4, "S\0\0\0", 4)                   = 4
read(6, "1. eth0\t\t192.168.122.204,fe80::6"..., 5120) = 244
--- SIGCHLD (Child exited) @ 0 (0) ---
read(6, "", 5120)                       = 0
close(6)                                = 0
close(4)                                = 0
waitpid(1993, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 1993
write(2, "Capturing on wlan0\n", 19)    = 19
pipe([4, 5])                            = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb78acb88) = 1996
close(5)                                = 0
read(4, "F\0\0\32", 4)                  = 4
read(4, "/var/tmp/tshark.out.wlan0\0", 26) = 26
read(4, "P\0\0\4", 4)                   = 4
read(4, "845\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "998\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "906\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "948\0", 4)                     = 4
read(4, "P\0\0\5", 4)                   = 4
read(4, "1147\0", 5)                    = 5
read(4, "P\0\0\4", 4)                   = 4
read(4, "689\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "666\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "527\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "723\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "895\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "479\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "833\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "736\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "591\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "486\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "849\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "930\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "842\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "872\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "584\0", 4)                     = 4
read(4, "P\0\0\4", 4)                   = 4
read(4, "526\0", 4)                     = 4
read(4, "P\0\0\3", 4)                   = 4
read(4, "66\0", 3)                      = 3
read(4, "P\0\0\4", 4)                   = 4
read(4, "107\0", 4)                     = 4
read(4, "P\0\0\3", 4)                   = 4
read(4, "96\0", 3)                      = 3
read(4,  <unfinished ...>

it keep on saying unfinished never ends...

I need some help on this.

Regards,
Mani.