Ethereal-users: Re: [ethereal-users] -S option

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Laurent Deniel <deniel@xxxxxxxxxxx>
Date: Wed, 28 Jul 1999 20:06:16 +0200
Guy Harris wrote:
> 
> > Ok, I should mention that I have not tested the -S option with wiretap so
> > one could expect other weird things ...
> 
> I suspect the only difference is that "libpcap" just returns -1 if a
> read doesn't get all the data it expects, while "wiretap" calls
> "abort()".
> 
> However, "libpcap" may leave the stream pointer in a the middle of the
> partial frame, in which case I wouldn't expect "-S" to work reading with
> "libpcap", either - so perhaps "fread()" doesn't leave the stream at EOF
> if a read doesn't return all the data asked for.

Ok, I can easily reproduce the problem with wiretap with a flood ping even 
on my slow ppp link, but I can't see any weird things with libpcap. So I
suspect that simultaneous dump/read with libpcap was safer than with wiretap
(but I can't see why yet :-). I will try to fix that. I already have a easy
fix but it will slow down the display process so I have to look further.

Laurent.

--
Laurent DENIEL        | E-mail: deniel@xxxxxxxxxxx
Paris, FRANCE         |         laurent.deniel@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
                      | WWW   : http://www.worldnet.fr/~deniel
    All above opinions are personal, unless stated otherwise.