Wireshark · Ethereal-dev: [Ethereal-dev] Capturing engine: Stop the capture child gracefully on Win32

[Ulf Lamping <ulf.lamping@xxxxxx>]

Hi List!

I had a problem with closing the capture child cleanly (gracefully)
while doing a capture.

On unix, to close the child we use the kill() system call (capture_sync,
line 786):

      kill(capture_opts->fork_child, SIGUSR1);

and the child having a signal handler stopping the capture_loop
(capture_loop.c, line 1040?).


Unfortunately, the kill() system call is not available on Win32 (but
e.g. signal() is...), so a different way had to be found. Some time ago
I added the TerminateProcess call to shutdown the child, but
TerminateProcess doesn't call any cleanup functions in the child, and as
Guy Harris already expected a while ago, this can end up with half
written packets causing the parent show a warning dialog box.

So I started investigating what can be done against this. After doing
some in depth Google and MSDN search and a lot of try and error, I ended
up in implementing a second pipe from the parent to the child to send a
quit message to the child. This is Win32 only, so the unix version
shouldn't be affected at all.

I've checked in the changes and this way it seems to be working well.

Regards, ULFL