Ethereal-users: Re: [Ethereal-users] Tethereal can, Ethereal cannot

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 19 May 2005 12:12:03 -0700
Ulf Lamping wrote:


I'll take a look on my debian box, so could someone explain (or point
me to info) how to use the pipe "mode"


Create the FIFO file with

	mkfifo /tmp/pipe
(really old UN*Xes might require "mknod p /tmp/pipe", but I don't know whether there are any interesting UN*Xes left that don't have "mkfifo"). 

Start up Ethereal capturing from a "device" named "/tmp/pipe".
Start up some process that writes a libpcap-format file (e.g., tcpdump writing to the file with "-w"), and have it write to "/tmp/pipe". 


Is this all about reading from a pipe, capturing from a pipe or even both?
It's about capturing from a pipe; we don't currently support reading from a pipe (Wiretap requires the ability to re-read input, so it can try reading the file as multiple file types; doing our own buffering might let us "seek backwards" by re-reading the buffered data).