Wireshark · Ethereal-dev: Re: [ethereal-dev] pipe capture checked in

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Sun, Jul 30, 2000 at 07:22:19PM +0200, Olivier Abad wrote:
> P.S. : this will not work with captures done with broken libpcap
> libraries from RedHat 6.1 and SuSE 6.3, because we can't seek on pipes
> to check the first record header (as in libpcap_open()).

If you assume that the program writing to the pipe was compiled with
whatever libpcap is installed on the system, then if you use libpcap
rather than Wiretap to read the capture file, that should make it work.

It should also simplify the code - you could get rid of
"pipe_open_live()", and just call "pcap_open_offline()" on the pipe, and
set "ld->from_pipe".  Many of the places that check "ld.from_pipe" would
no longer have to do so, though, as you'd set "pch" to the result of
"pcap_open_offline()", and the encapsulation type and snapshot length
could be gotten from "pcap_datalink()" and "pcap_snapshot()" as is done
for captures done with "pcap_open_live()".