[Alastair Scott <ads@xxxxxxxxxx>]

Thanks Guy! I tested your fix myself and it solved my problem.

Regards,

Alastair

On Fri, Nov 20, 2020 at 12:37 AM Guy Harris <gharris@xxxxxxxxx> wrote:

On Nov 19, 2020, at 9:07 PM, Alastair Scott <ads@xxxxxxxxxx> wrote:

> Do you know where in the code base I could look for a potential remedy to this issue? I'm trying to find a place to add a delay to ensure the read does not come early.

What needs to be delayed is the sending of the SP_FILE message from dumpcap to TShark/Wireshark when in "pcapng passthrough" mode.  See merge request !977:

        https://gitlab.com/wireshark/wireshark/-/merge_requests/977

which does exactly that, and my comment in issue #17013:

        https://gitlab.com/wireshark/wireshark/-/issues/17013#note_451496651
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe