Wireshark · Ethereal-users: Re: [Ethereal-users] Command in order to stop tethereal capture

[Guy Harris <gharris@xxxxxxxxx>]

Andrew Hood wrote:

> Which only works if you have it running at a command prompt. What if it
> was run from an init script or cron or Window's equivalents? It might be
> better expressed as "send it a TERM signal".
>
> Ctrl-C
>
> kill -TERM <processid>

...on UN*Xes.

> pskill tethereal
> see http://www.sysinternals.com/Utilities/PsKill.html

...on Windows NT ("NT" including NT 5.x, i.e. W2K/WXP/WServer2K3, and 
possibly 6.0, i.e. Vista).  However, does that just terminate the 
process uncleanly (similarly to "kill -KILL" on UN*Xes), or does it 
cause some indication to be delivered to the process, such as a "CTRL 
event":

	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/setconsolectrlhandler.asp

If it just terminates the process uncleanly, the last few packets 
captured probably won't be saved to the capture file (and some packet 
might be partially written) and if you try to read the file you'll 
probably get an error at the end (the packets completely written to the 
file will be readable).

*Is* there a Windows equivalent of SIGTERM for non-GUI processes (I 
infer that when you shut Windows down from the GUI, it first delivers a 
polite "please shut yourself down" message of some sort to at least some 
processes, and if they don't exit after some amount of time, they offer 
to let you just kill off the process, but if the "please shut yourself 
down" message is a window system message, Tethereal won't see it)?