Wireshark-users: Re: [Wireshark-users] Can ethereal read from a capture file that itself is conti
Keith Fleming wrote:
We have an SS7 monitoring tool that is able to write out to stdout raw
SS7 MTP3 data. I already have a tool that will convert this to PCAP
format. Is it possible to setup ethereal to read from a PCAP file, that
is itself being written to?
No, it can't. Well, it can read the file, but it won't pick up the data
being appended until you reload the file.
Or is there an easy way to make a �dummy� interface for ethereal to
capture from, fooling it into thinking that it is reading from a network
interface?
Wireshark can (at least on UNIX) read from pipes or named pipes, that
might suit your need.