Wireshark · Ethereal-dev: Re: [Ethereal-dev] Decoding packets while writing to file with tethereal

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Aug 20, 2002 at 06:32:54PM +0200, Joerg Mayer wrote:
> I've just written a small patch that allows to decode the captured packets
> while writing them to file. The Option to do that is -Q (as opposed to -q).
> I'm not sure that the behaviour and the combination of flags is that useful,

The behavior is potentially useful - think of it as the Tethereal
equivalent of "Update list of packets in real time" (so you can capture
to a file and see what's being captured at the same time).

I'm not sure 'Q' is the right letter - it's not just the antithesis of
"-q", it's noisier than the default - but that's the problem with the
UNIX tradition of single-letter command-line flags, you run out of
reasonable letters of the alphabet.

Perhaps "-S" would be appropriate if it's viewed as equivalent to
"Update list of packets in real time" in Ethereal (as "-S" is what
does that in Ethereal).

> Current behaviour (including my patch):
> 
> Option(s)	Action
> none		capture and decode to stdout
> -w file		capture to file, print number of packets to stderr
> -q -w file	capture to file
> -Q -w file	capture to file and decode to stdout   <--new
> 
> I'd prefer something like the following, because the behaviour of
> printing a packet is not influenced by whether it is being written to file.
> 
> none		capture and decode to stdout
> -w file		capture to file and decode to stdout
> -q -w file	capture to file, print number of packets to stderr

Unfortunately, those change the behavior even when you're not using
"-Q"; people might expect "-w" not to decode to stdout, and might expect
"-q" with "-w" not to write anything to stdout, and might even have
scripts that assume that.