Wireshark-bugs: [Wireshark-bugs] [Bug 2602] dumpcap / tshark do not seem to capture all message
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2602
--- Comment #6 from Guy Harris <guy@xxxxxxxxxxxx> 2008-06-12 12:02:49 PDT ---
At least according to
http://java.sun.com/j2se/1.4.2/docs/api/java/lang/Process.html#destroy()
the destroy method on a Process object forcibly terminates the process.
That presumably means killing with SIGKILL on UN*X and the equivalent in
Windows. That would mean that *no* indication that this is happening is
delivered to the process, giving it *no* ability to clean up - it doesn't
gracefully exit, it's forcibly terminated, so the stuff it does before exiting
isn't allowed to happen.
If this were UN*X, you could send SIGTERM to the process - although you'd have
to go outside Java to do that, as far as I can tell - and that would notify
dumpcap and allow it to terminate gracefully. There's no equivalent for that
in dumpcap on Windows.
Your only option would be to run dumpcap in the same mode in which Wireshark
runs it, read the packet counts it sends up to its parent over a pipe, and send
it a signal over another pipe to tell it to terminate. You'd have to look at
Wireshark to see how that's done.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
