Guy Harris wrote:
Andrew Hood wrote:
pskill tethereal
see http://www.sysinternals.com/Utilities/PsKill.html
...on Windows NT ("NT" including NT 5.x, i.e. W2K/WXP/WServer2K3, and
possibly 6.0, i.e. Vista). However, does that just terminate the
process uncleanly (similarly to "kill -KILL" on UN*Xes), or does it
cause some indication to be delivered to the process, such as a "CTRL
event":
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/setconsolectrlhandler.asp
If it just terminates the process uncleanly, the last few packets
captured probably won't be saved to the capture file (and some packet
might be partially written) and if you try to read the file you'll
probably get an error at the end (the packets completely written to
the file will be readable).
*Is* there a Windows equivalent of SIGTERM for non-GUI processes (I
infer that when you shut Windows down from the GUI, it first delivers
a polite "please shut yourself down" message of some sort to at least
some processes, and if they don't exit after some amount of time, they
offer to let you just kill off the process, but if the "please shut
yourself down" message is a window system message, Tethereal won't see
it)?
There are two "please shut yourself down" messages I know of: WM_CLOSE
and WM_QUIT.
WM_CLOSE is the polite version you talk about, used when you e.g. use
the X on the top right corner.
WM_QUIT is a more "hardcore" version, but much less used.
Of course, both messages are only useful for a program which uses a
message loop. Note that it's not limited to GUI applications to have a
message loop, but can be complicated to do so.
Sending signals to politely quit an application seems to be impossible
(every tips welcome how to do this cleanly), I've tried a lot of
different approaches while redesigning the capture slave in Ethereal,
but end up using a pipe to signal this "end of capture" messages
cleanly, everything else I tried (e.g. using signals) simply terminated
the slave process, leaving some captured packets "left alone".
Regards, ULFL
P.S: Could someone please start a wiki page on this, so we don't have to
start the same discussion in six month or so again?
